RHSA-2026:56912

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes.

gRPC-Go is the Go language implementation of gRPC.

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Prometheus is an open-source monitoring system and time series database.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.

A flaw was found in openshift/oauth-proxy.

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy.

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers.