Red Hat Security Advisory

RHSA-2026:83601

RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release

Released 2026-10-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/ctlog-monitor-rhel9, registry.redhat.io/rhtas/rekor-monitor-rhel9

Fixes 3 records

TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835

OpenTelemetry-Go's baggage parsing no longer caps raw header length

MEDIUM 63

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00336 Published 2026-06-04 Partial fix · 1.42.0, 1.44.0 CWE-789

TI-2026-58035 CVE-2026-84445 · GHSA-2v4p-qf9q-27wj

gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers

MEDIUM 45

gRPC-Go is the Go language implementation of gRPC.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00641 Published 2026-09-14 Partial fix · 1.82.2, 1.83.2 +2 CWE-129

TI-2026-40994 CVE-2026-56854 · GHSA-gjhq-gjfw-99mq

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

LOW 39

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00437 Published 2026-08-28 Partial fix · 0.55.0 CWE-863