Red Hat Security AdvisoryRHSA-2026:72879
Red Hat Advanced Cluster Management for Kubernetes v2.17.3 security update
Released 2026-09-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +7
Fixes 5 records
Priority HIGH 66
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory.
CVSS 4.0HIGH 7.1· Local · No auth · User interaction · EPSS 0.0044 · Published 2026-08-18 · Partial fix · 0.3.0, 0.38.0 +3 CWE-59
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00336 · Published 2026-06-04 · Partial fix · 1.42.0, 1.44.0 CWE-789
Priority MEDIUM 45
gRPC-Go is the Go language implementation of gRPC.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00641 · Published 2026-09-14 · Partial fix · 1.82.2, 1.83.2 +2 CWE-129
Priority MEDIUM 40
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00549 · Published 2026-07-21 · Partial fix · 1.26.6, 1.27.0-rc.3 +1 CWE-125
Priority LOW 39
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00475 · Published 2026-07-21 · Partial fix · 0.39.0 CWE-835
