Read the docs
TI-2023-24280 Aliases CVE-2023-45290GHSA-rr6r-cfgf-gc6h

Memory exhaustion in multipart form parsing in net/textproto and net/http

Priority LOW 31CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 36 fixed, 38 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01165 67th percentileScored 2026-11-07
Fix Partial net/textproto (Go standard library): 1.21.8, 1.22.1Red Hat: 46 advisoriesRed Hat: 36 fixed, 38 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarynet/textprotobefore 1.21.8; 1.22.0-0 to before 1.22.11.21.8, 1.22.1Patch availableCNA
  • net/textproto VendorGo standard library Affected before 1.21.8; 1.22.0-0 to before 1.22.1 Fixed in 1.21.8, 1.22.1 Patch available CNA

Remediation

  • Fix · CNA net/textproto (Go standard library) Fixed in 1.21.8, 1.22.1

Red Hat 46 advisories

  • RHSA-2025:11889 Released 2025-07-28 · Red Hat rating Important
    7.1 container image is now available in the Red Hat Ecosystem Catalog.
    • Red Hat Ceph Storage 7.1 Tools rhceph/grafana-rhel10, rhceph/grafana-rhel9, rhceph/keepalived-rhel9 +4
  • RHSA-2025:9776 Released 2025-06-26 · Red Hat rating Important
    New RHCS 8.1 container image is now available in the Red Hat Ecosystem Catalog.
    • Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9, rhceph/keepalived-rhel9, rhceph/oauth2-proxy-rhel9 +4
  • RHSA-2024:9485 Released 2024-11-13 · Red Hat rating Important
    Control plane Operators for RHOSO 18.0.3 (Feature Release 1) security update
    • 9Base-RHOSO-1.0-PODIFIED rhoso-operators/barbican-rhel9-operator, rhoso-operators/cinder-rhel9-operator, rhoso-operators/designate-rhel9-operator +22
Show 43 more Red Hat advisories
  • RHSA-2024:9135 Released 2024-11-12 · Red Hat rating Moderate
    toolbox security update
    • Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.5-5.el9, toolbox-tests-0.0.99.5-5.el9
  • RHSA-2024:7922 Released 2024-10-16 · Red Hat rating Important
    OpenShift Container Platform 4.17.1 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2024:7548 Released 2024-10-16 · Red Hat rating Moderate
    Run Once Duration Override Operator for Red Hat OpenShift 1.2.0 for RHEL 9
    • RODOO 1.2 for RHEL 9 run-once-duration-override-operator/run-once-duration-override-operator-bundle, run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator
  • RHSA-2024:8038 Released 2024-10-14 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+22346+28c02849.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+22346+28c02849.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+22346+28c02849.s390x::container-tools:rhel8 +47
  • RHSA-2024:7174 Released 2024-10-02 · Red Hat rating Important
    OpenShift Container Platform 4.16.15 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2024:6969 Released 2024-09-24 · Red Hat rating Moderate
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22283+6d6d094a.s390x::container-tools:rhel8 +47
  • RHSA-2024:6221 Released 2024-09-03 · Red Hat rating Critical
    The Red Hat OpenShift Builds 1.1.0 General Availability
    • Builds for Red Hat OpenShift
  • RHSA-2024:5810 Released 2024-08-29 · Red Hat rating Important
    OpenShift Container Platform 4.12.64 security update
    • Ironic content for Red Hat OpenShift Container Platform 4.12 python-jinja2-3.0.1-3.el9.1, python-werkzeug-2.0.3-6.el9, python3-jinja2-3.0.1-3.el9.1 +1
    • Red Hat OpenShift Container Platform 4.12 openshift-4.12.0-202408131833.p0.g1eb8682.assembly.stream.el8, openshift-4.12.0-202408131833.p0.g1eb8682.assembly.stream.el9, openshift-hyperkube-4.12.0-202408131833.p0.g1eb8682.assembly.stream.el8 +1
  • RHSA-2024:5808 Released 2024-08-29 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.64 security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2024:5446 Released 2024-08-22 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.48 packages and security update
    • Red Hat OpenShift Container Platform 4.13 cri-o-1.26.5-20.rhaos4.13.git2e90133.el8, cri-o-1.26.5-20.rhaos4.13.git2e90133.el9, openshift-4.13.0-202408092110.p0.ge0953cc.assembly.stream.el8 +16
  • RHSA-2024:5442 Released 2024-08-22 · Red Hat rating Moderate
    OpenShift Container Platform 4.15.28 packages and security update
    • Red Hat OpenShift Container Platform 4.15 cri-o-1.28.9-5.rhaos4.15.git674ed4c.el8, cri-o-1.28.9-5.rhaos4.15.git674ed4c.el9, openshift-4.15.0-202408091502.p0.g396c881.assembly.stream.el8 +22
  • RHSA-2024:5436 Released 2024-08-22 · Red Hat rating Moderate
    OpenShift Container Platform 4.14.35 security update
    • Red Hat OpenShift Container Platform 4.14 cri-o-1.27.8-5.rhaos4.14.git107168f.el8, cri-o-1.27.8-5.rhaos4.14.git107168f.el9, openshift-4.14.0-202408071611.p0.ge826056.assembly.stream.el8 +18
  • RHSA-2024:5444 Released 2024-08-22 · Red Hat rating Important
    OpenShift Container Platform 4.13.48 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2024:5439 Released 2024-08-22 · Red Hat rating Important
    OpenShift Container Platform 4.15.28 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2024:5433 Released 2024-08-22 · Red Hat rating Important
    OpenShift Container Platform 4.14.35 security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2024:5202 Released 2024-08-19 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.63 packages and security update
    • Red Hat OpenShift Container Platform 4.12 cri-o-1.25.3-7.rhaos4.12.git44a2cb2.el9, cri-o-1.25.5-25.rhaos4.12.git6556f50.el8, podman-3:4.2.0-11.rhaos4.12.el9 +13
  • RHSA-2024:5258 Released 2024-08-13 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.s390x::container-tools:rhel8 +47
  • RHSA-2024:5077 Released 2024-08-07 · Red Hat rating Moderate
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-2.module+el8.8.0+22004+c5f8797c.aarch64::go-toolset:rhel8 +18
  • RHSA-2024:5075 Released 2024-08-07 · Red Hat rating Moderate
    golang security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) golang-1.19.13-9.el9_2, golang-bin-1.19.13-9.el9_2, golang-docs-1.19.13-9.el9_2 +4
  • RHSA-2024:5013 Released 2024-08-05 · Red Hat rating Critical
    The Red Hat OpenShift Builds Client 1.1.0 General Availability
    • Builds for Red Hat OpenShift 1.1.1 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-rhel9-operator, registry.redhat.io/openshift-builds/openshift-builds-waiters-rhel9
  • RHSA-2024:4893 Released 2024-07-29 · Red Hat rating Moderate
    rhc-worker-script security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) rhc-worker-script-0.9-5.el7_9
  • RHSA-2024:4520 Released 2024-07-11 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.7.16 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-rsync-transfer-rhel8 +2
  • RHSA-2024:3617 Released 2024-07-01 · Red Hat rating Moderate
    Kube Descheduler Operator for Red Hat OpenShift 5.0.1 for RHEL 9
    • KDO 5.0 for RHEL 9 kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-operator-bundle, kube-descheduler-operator/kube-descheduler-rhel9-operator
  • RHSA-2024:3637 Released 2024-07-01 · Red Hat rating Moderate
    Secondary Scheduler Operator for Red Hat OpenShift 1.3.0 for RHEL 9
    • OSSO 1.3 for RHEL 9 openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle, openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator
  • RHSA-2024:1616 Released 2024-07-01 · Red Hat rating Important
    Run Once Duration Override Operator for Red Hat OpenShift 1.1.1 for RHEL 9
    • RODOO 1.1 for RHEL 9 run-once-duration-override-operator/run-once-duration-override-operator-bundle, run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator
  • RHSA-2024:0045 Released 2024-06-27 · Red Hat rating Important
    OpenShift Container Platform 4.16.0 security update
    • Ironic content for Red Hat OpenShift Container Platform 4.16 python-eventlet-0.33.1-6.el9, python3-eventlet-0.33.1-6.el9
    • Red Hat OpenShift Container Platform 4.16 butane-0.21.0-1.rhaos4.16.el8, butane-redistributable-0.21.0-1.rhaos4.16.el8, cri-o-1.29.5-5.rhaos4.16.git7032128.el8 +43
  • RHSA-2024:4023 Released 2024-06-20 · Red Hat rating Important
    Release of openshift-serverless-clients kn 1.33.0 security update & enhancements
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.12.0-7.el8
  • RHSA-2024:3868 Released 2024-06-17 · Red Hat rating Important
    Network Observability 1.6.0 for OpenShift
    • NETOBSERV 1.6 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
  • RHSA-2024:3827 Released 2024-06-11 · Red Hat rating Moderate
    buildah security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.33.7-2.el9_4, buildah-tests-2:1.33.7-2.el9_4
  • RHSA-2024:3826 Released 2024-06-11 · Red Hat rating Moderate
    podman security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-4:4.9.4-4.el9_4, podman-docker-4:4.9.4-4.el9_4, podman-plugins-4:4.9.4-4.el9_4 +2
  • RHSA-2024:3830 Released 2024-06-11 · Red Hat rating Moderate
    gvisor-tap-vsock security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) gvisor-tap-vsock-6:0.7.3-3.el9_4
  • RHSA-2024:3831 Released 2024-06-11 · Red Hat rating Moderate
    containernetworking-plugins security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.4.0-3.el9_4
  • RHSA-2024:3790 Released 2024-06-11 · Red Hat rating Moderate
    OpenShift API for Data Protection (OADP) 1.3.2 security and bug fix update
    • 9Base-OADP-1.3 oadp/oadp-velero-plugin-rhel9, oadp/oadp-velero-rhel9
  • RHSA-2024:3781 Released 2024-06-10 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.7-1.el8ap, automation-hub-4.9.2-1.el8ap, python39-aiohttp-3.9.5-1.el8ap +25
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.7-1.el9ap, automation-hub-4.9.2-1.el9ap, python-aiohttp-3.9.5-1.el9ap +25
  • RHSA-2024:3621 Released 2024-06-05 · Red Hat rating Important
    Red Hat OpenShift distributed tracing 3.2.0 operator/operand containers update
    • Red Hat OpenShift distributed tracing 3.2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +16
  • RHSA-2024:3346 Released 2024-05-23 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream (v. 8) git-lfs-3.4.1-2.el8_10
  • RHSA-2024:2901 Released 2024-05-23 · Red Hat rating Low
    Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-394 Security Update
    • OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle +2
  • RHSA-2024:3259 Released 2024-05-22 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64::go-toolset:rhel8, delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le::go-toolset:rhel8, delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.src::go-toolset:rhel8 +19
  • RHSA-2024:2941 Released 2024-05-21 · Red Hat rating Important
    RHACS 4.4 enhancement and security update
    • RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2024:2724 Released 2024-05-07 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.4.1-2.el9_4
  • RHSA-2024:2096 Released 2024-05-01 · Red Hat rating Moderate
    security update Logging for Red Hat OpenShift - 5.9.1
    • RHOL 5.9 for RHEL 9 openshift-logging/logging-loki-rhel9, openshift-logging/lokistack-gateway-rhel9
  • RHSA-2024:2562 Released 2024-04-30 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.21.9-2.el9_4, golang-1.21.9-2.el9_4, golang-bin-1.21.9-2.el9_4 +4
  • RHSA-2024:2088 Released 2024-04-29 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cost Management Metrics OperatorAffectedNo fix yet
Fence Agents Remediation OperatorAffectedNo fix planned: Will not fix
Machine Deletion Remediation OperatorAffectedNo fix yet
Migration Toolkit for Applications 6AffectedNo fix planned: Will not fix
Multicluster Engine for KubernetesAffectedNo fix planned: Will not fix
NBDE Tang ServerAffectedNo fix planned: Will not fix
Node HealthCheck OperatorAffectedNo fix planned: Will not fix
Node Maintenance OperatorAffectedNo fix planned: Will not fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix planned: Will not fix
OpenShift Source-to-Image (S2I)AffectedNo fix yet
Power monitoring for Red Hat OpenShiftAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Out of support scope
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 5AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 6AffectedNo fix planned: Will not fix
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Certification for Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 17.1AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 18.0AffectedNo fix planned: Will not fix
Red Hat Openshift Sandboxed ContainersAffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Service Interconnect 1AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Out of support scope
Red Hat Web TerminalAffectedNo fix yet: Fix deferred
Self Node Remediation OperatorAffectedNo fix yet
8Base-MTV-2.6Fixed—
8Base-RHMTC-1.7Fixed RHSA-2024:4520
9Base-OADP-1.3Fixed RHSA-2024:3790
9Base-RHOSO-1.0-PODIFIEDFixed RHSA-2024:9485
Builds for Red Hat OpenShiftFixed RHSA-2024:6221
Builds for Red Hat OpenShift 1.1.1Fixed RHSA-2024:5013
Cryostat 2 on RHEL 8Fixed RHSA-2024:2088
KDO 5.0 for RHEL 9Fixed RHSA-2024:3617
LVMS 4.13 for RHEL 8Fixed—
LVMS 4.14 for RHEL 9Fixed—
LVMS 4.15 for RHEL 9Fixed—
LVMS 4.16 for RHEL 9Fixed—
NETOBSERV 1.6 for RHEL 9Fixed RHSA-2024:3868
OSSO 1.3 for RHEL 9Fixed RHSA-2024:3637
OpenShift Custom Metrics Autoscaler 2Fixed RHSA-2024:2901
RHACS 4.4 for RHEL 8Fixed RHSA-2024:2941
RHOL 5.9 for RHEL 9Fixed RHSA-2024:2096
RODOO 1.1 for RHEL 9Fixed RHSA-2024:1616
RODOO 1.2 for RHEL 9Fixed RHSA-2024:7548
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2024:3781
Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed RHSA-2024:3781
Red Hat Ceph Storage 7.1 ToolsFixed RHSA-2025:11889
Red Hat Ceph Storage 8.1 ToolsFixed RHSA-2025:9776
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:3259, RHSA-2024:3346, RHSA-2024:5258, RHSA-2024:6969, RHSA-2024:8038
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:2562, RHSA-2024:2724, RHSA-2024:3826, RHSA-2024:3827, RHSA-2024:3830, RHSA-2024:3831, RHSA-2024:9135
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:5077
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:5075
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2024:4893
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2024:5202, RHSA-2024:5808, RHSA-2024:5810
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2024:5444, RHSA-2024:5446
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2024:5433, RHSA-2024:5436
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2024:5439, RHSA-2024:5442
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:0045, RHSA-2024:7174
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2024:7922
Red Hat OpenShift Serverless 1.0Fixed RHSA-2024:4023
Red Hat OpenShift distributed tracing 3.2Fixed RHSA-2024:3621
Not affected: 23 products
  • 8Base-RHMTC-1.7
  • 9Base-OADP-1.3
  • Builds for Red Hat OpenShift 1.1.1
  • Ironic content for Red Hat OpenShift Container Platform 4.12
  • Ironic content for Red Hat OpenShift Container Platform 4.13
  • Ironic content for Red Hat OpenShift Container Platform 4.16
  • Migration Toolkit for Applications 7
  • RHOL 5.9 for RHEL 9
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4
  • Service Telemetry Framework 1.5
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45290
  2. 2026-10-03 Alias added: GHSA-rr6r-cfgf-gc6h
  3. 2026-10-30 Fix available: 8Base-MTV-2.6, LVMS 4.15 for RHEL 9, LVMS 4.16 for RHEL 9 · Red Hat

References

Other 6

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences