Red Hat Security Advisory

RHSA-2026:37278

RHTAS 1.4.2 - Tech Preview Release Of the Go based Model Transparency CLI

Released 2026-07-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-cli-rhel9

Fixes 3 records

TI-2026-28712 CVE-2026-39830 · GHSA-vgwf-h737-ff37

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

MEDIUM 46

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00683 Published 2026-05-22 Partial fix · 0.52.0 CWE-119

TI-2026-28711 CVE-2026-39829 · GHSA-w879-237q-wc7r

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

LOW 39

The RSA and DSA public key parsers did not enforce size limits on key parameters.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00467 Published 2026-05-22 Partial fix · 0.52.0 CWE-347

TI-2026-28710 CVE-2026-39828 · GHSA-45gg-vh54-h5m9

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

LOW 28

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a sec…

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00369 Published 2026-05-22 Partial fix · 0.52.0 CWE-295