Red Hat Security Advisory

RHSA-2026:42082

Satellite 6.16.11 Async Update

Released 2026-07-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Satellite 6.16 for RHEL 8 python-pulpcore-3.49.39-2.el8pc, python3.11-pulpcore-3.49.39-2.el8pc, yggdrasil-worker-forwarder-0.0.4-1.el8sat
Red Hat Satellite 6.16 for RHEL 9 python-pulpcore-3.49.39-2.el9pc, python3.11-pulpcore-3.49.39-2.el9pc, yggdrasil-worker-forwarder-0.0.4-1.el9sat

Fixes 4 records

TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

MEDIUM 47

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01834 Published 2026-05-22 Partial fix · 1.25.13, 1.26.6 +2 CWE-1289

TI-2026-10860 CVE-2026-12701 · GHSA-j5cg-p988-g42q

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

MEDIUM 41

A path traversal vulnerability was found in pulpcore.

CVSS 3.1CRITICAL 9.0 Network High privileges No interaction EPSS 0.01194 Published 2026-07-20 Partial fix · 3.49.63-2.el8ap, 3.49.63-2.el9ap +7 CWE-22

TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478

Crash when handling long CNAME response in net

MEDIUM 40

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00875 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-415

TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r

Inefficient candidate hostname parsing in crypto/x509

LOW 30

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00591 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4