Red Hat Security Advisory

RHSA-2026:54525

external secrets operator for Red Hat OpenShift 1.1.1

Released 2026-08-13 · Red Hat rating Important · View on Red Hat →

Fixed in

external secrets operator for Red Hat OpenShift 1.1 registry.redhat.io/external-secrets-operator/external-secrets-rhel9

Fixes 4 records

TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r

Infinite loop on invalid input in golang.org/x/text

LOW 39

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00475 Published 2026-07-21 Partial fix · 0.39.0 CWE-835

TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r

Inefficient candidate hostname parsing in crypto/x509

LOW 30

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00591 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4

TI-2026-32627 CVE-2026-44740 · GHSA-m3xc-h892-ggx6

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

LOW 29

Billy is an interface filesystem abstraction for Go.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00389 Published 2026-06-01 Partial fix · 5.9.0, 6.0.0-alpha.1 CWE-674

TI-2026-28717 CVE-2026-39835 · GHSA-78mq-xcr3-xm33

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

LOW 25

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00504 Published 2026-05-22 Partial fix · 0.52.0 CWE-295