Read the docs
TI-2024-30406 Aliases CVE-2024-45336GHSA-7wrw-r4p8-38rx

Sensitive headers incorrectly sent after cross-domain redirect in net/http

Priority LOW 28Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 28 fixed, 57 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0071 53rd percentileScored 2026-11-07
Fix Partial net/http (Go standard library): 1.22.11, 1.23.5, 1.24.0-rc.2Red Hat: 42 advisoriesRed Hat: 28 fixed, 57 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarynet/httpbefore 1.22.11; 1.23.0-0 to before 1.23.5; 1.24.0-0 to before 1.24.0-rc.21.22.11, 1.23.5, 1.24.0-rc.2Patch availableCNA
  • net/http VendorGo standard library Affected before 1.22.11; 1.23.0-0 to before 1.23.5; 1.24.0-0 to before 1.24.0-rc.2 Fixed in 1.22.11, 1.23.5, 1.24.0-rc.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*——Go standard library

Remediation

  • Fix · CNA net/http (Go standard library) Fixed in 1.22.11, 1.23.5, 1.24.0-rc.2

Red Hat 42 advisories

  • RHSA-2026:95234 Released 2026-11-04 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) git-lfs-2.13.3-3.el8_4.6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) git-lfs-2.13.3-3.el8_4.6
  • RHSA-2026:94074 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.14.2 release.
    • Red Hat Web Terminal 1.14 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94072 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.11.3 release.
    • Red Hat Web Terminal 1.11 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
Show 39 more Red Hat advisories
  • RHSA-2026:94070 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.13.2 release.
    • Red Hat Web Terminal 1.13 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:92217 Released 2026-10-29 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) rhc-1:0.2.0-6.el8_4.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) rhc-1:0.2.0-6.el8_4.2
  • RHSA-2026:90994 Released 2026-10-27 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:90726 Released 2026-10-27 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) rhc-1:0.2.2-1.el8_8.3
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) rhc-1:0.2.2-1.el8_8.3
  • RHSA-2026:90725 Released 2026-10-27 · Red Hat rating Important
    rhc security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) rhc-1:0.2.1-14.el8_6.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) rhc-1:0.2.1-14.el8_6.1
  • RHSA-2026:88395 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) grafana-pcp-3.2.0-6.el8_8.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) grafana-pcp-3.2.0-6.el8_8.2
  • RHSA-2026:88394 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) grafana-pcp-3.2.0-4.el8_6.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) grafana-pcp-3.2.0-4.el8_6.2
  • RHSA-2026:88340 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) grafana-7.5.15-12.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) grafana-7.5.15-12.el8_8
  • RHSA-2026:88339 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) grafana-7.5.11-12.el8_6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) grafana-7.5.11-12.el8_6
  • RHSA-2026:87245 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8 +13
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.8.0+25113+a148ecc0.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:87246 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:72805 Released 2026-09-28 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) git-lfs-2.13.3-3.el8_6.8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) git-lfs-2.13.3-3.el8_6.8
  • RHSA-2026:72737 Released 2026-09-28 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) git-lfs-3.2.0-2.el8_8.8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) git-lfs-3.2.0-2.el8_8.8
  • RHSA-2026:69235 Released 2026-09-21 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) osbuild-composer-46.3-8.el8_6, osbuild-composer-core-46.3-8.el8_6, osbuild-composer-dnf-json-46.3-8.el8_6 +1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) osbuild-composer-46.3-8.el8_6, osbuild-composer-core-46.3-8.el8_6, osbuild-composer-dnf-json-46.3-8.el8_6 +1
  • RHSA-2026:68504 Released 2026-09-17 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) osbuild-composer-75-10.el8_8, osbuild-composer-core-75-10.el8_8, osbuild-composer-dnf-json-75-10.el8_8 +1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) osbuild-composer-75-10.el8_8, osbuild-composer-core-75-10.el8_8, osbuild-composer-dnf-json-75-10.el8_8 +1
  • RHSA-2026:66016 Released 2026-09-09 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-101.5-2.el8_10, osbuild-composer-core-101.5-2.el8_10, osbuild-composer-worker-101.5-2.el8_10
  • RHSA-2026:59579 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.14 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +17
  • RHSA-2026:59559 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.7 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +15
  • RHSA-2026:59558 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.10 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9 +20
  • RHSA-2026:59557 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.6 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +16
  • RHSA-2026:59556 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.6 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +14
  • RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.5 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
  • RHSA-2026:54432 Released 2026-08-12 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.5 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +1
  • RHSA-2026:4693 Released 2026-03-17 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8, buildah-1:1.29.7-1.module+el8.8.0+24026+ca15dd94.src::container-tools:rhel8 +47
  • RHSA-2025:9514 Released 2025-06-24 · Red Hat rating Moderate
    rhc security update
    • Red Hat Enterprise Linux AppStream (v. 10) rhc-1:0.3.2-1.el10_0
  • RHSA-2025:7624 Released 2025-05-14 · Red Hat rating Moderate
    Satellite 6 Client Bug Fix Update
    • Satellite Client 6 for RHEL 10 foreman_ygg_worker-0.3.1-1.el10sat
    • Satellite Client 6 for RHEL 8 foreman_ygg_worker-0.3.1-1.el8sat, yggdrasil-0.2.3-3.el8sat
    • Satellite Client 6 for RHEL 9 foreman_ygg_worker-0.3.1-1.el9sat, yggdrasil-0.2.3-3.el9sat
  • RHSA-2025:7592 Released 2025-05-14 · Red Hat rating Important
    yggdrasil security update
    • Red Hat Enterprise Linux AppStream (v. 10) yggdrasil-0.4.5-3.el10_0
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) yggdrasil-devel-0.4.5-3.el10_0
  • RHSA-2025:7466 Released 2025-05-13 · Red Hat rating Moderate
    delve and golang security update
    • Red Hat Enterprise Linux AppStream (v. 10) delve-1.24.1-1.el10_0, go-toolset-1.23.7-1.el10_0, golang-1.23.7-1.el10_0 +5
  • RHSA-2025:7326 Released 2025-05-13 · Red Hat rating Moderate
    rhc security update
    • Red Hat Enterprise Linux AppStream (v. 9) rhc-1:0.2.6-3.el9_6
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) rhc-devel-1:0.2.6-3.el9_6
  • RHSA-2025:4810 Released 2025-05-12 · Red Hat rating Important
    RHSA: Submariner 0.18.5 - bug and security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/nettest-rhel9 +6
  • RHSA-2025:4666 Released 2025-05-07 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.11.7 container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/acm-grafana-rhel9, rhacm2/acm-prometheus-config-reloader-rhel9, rhacm2/acm-prometheus-rhel9 +16
  • RHSA-2025:4667 Released 2025-05-07 · Red Hat rating Moderate
    Updated 7.1 container image is now available in the Red Hat Ecosystem Catalog.
    • Red Hat Ceph Storage 7.1 Tools rhceph/grafana-rhel9, rhceph/keepalived-rhel9, rhceph/rhceph-7-rhel9 +3
  • RHSA-2025:3922 Released 2025-04-15 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh Containers for 2.5.10
    • RHOSSM 2.5 for RHEL 8 openshift-service-mesh/kiali-rhel8
  • RHSA-2025:3772 Released 2025-04-10 · Red Hat rating Moderate
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64::go-toolset:rhel8, delve-1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le::go-toolset:rhel8, delve-1.24.1-1.module+el8.10.0+22945+b2c96a17.src::go-toolset:rhel8 +19
  • RHSA-2025:3773 Released 2025-04-10 · Red Hat rating Important
    delve and golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) delve-1.24.1-2.el9_5, go-toolset-1.23.6-2.el9_5, golang-1.23.6-2.el9_5 +6
  • RHSA-2025:3593 Released 2025-04-03 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) opentelemetry-collector-0.107.0-7.el9_4
  • RHSA-2025:3335 Released 2025-03-27 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.107.0-8.el9_5
  • RHSA-2025:3131 Released 2025-03-26 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.1.4
    • RHOL 6.1 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +7
  • RHSA-2025:2789 Released 2025-03-13 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.5.0 release
    • Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/opentelemetry-collector-rhel8, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Builds for Red Hat OpenShiftAffectedNo fix yet
Cryostat 3AffectedNo fix yet: Fix deferred
Deployment Validation OperatorAffectedNo fix yet
Fence Agents Remediation OperatorAffectedNo fix yet: Fix deferred
Kube Descheduler OperatorAffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
Logical Volume Manager StorageAffectedNo fix yet: Fix deferred
Machine Deletion Remediation OperatorAffectedNo fix yet: Fix deferred
Migration Toolkit for Applications 7AffectedNo fix yet: Fix deferred
Migration Toolkit for ContainersAffectedNo fix yet: Fix deferred
Migration Toolkit for VirtualizationAffectedNo fix yet: Fix deferred
Multicluster Engine for KubernetesAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet: Fix deferred
Node Maintenance OperatorAffectedNo fix yet: Fix deferred
OpenShift API for Data ProtectionAffectedNo fix yet: Fix deferred
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet: Fix deferred
OpenShift PipelinesAffectedNo fix yet
OpenShift Run Once Duration Override OperatorAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix yet: Fix deferred
OpenShift Service Mesh 3AffectedNo fix yet
OpenShift Source-to-Image (S2I)AffectedNo fix yet
Power monitoring for Red Hat OpenShiftAffectedNo fix yet: Fix deferred
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 1.2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Cluster Manager CLIAffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix yet
Red Hat OpenStack Platform 18.0AffectedNo fix yet: Fix deferred
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Openshift Sandboxed ContainersAffectedNo fix yet: Fix deferred
Red Hat Quay 3AffectedNo fix yet: Fix deferred
Red Hat Runtimes Inventory OperatorAffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Service Interconnect 1AffectedNo fix yet: Fix deferred
Red Hat Storage 3AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Red Hat Web TerminalAffectedNo fix yet
Self Node Remediation OperatorAffectedNo fix yet: Fix deferred
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
RHOL 6.1 for RHEL 9Fixed RHSA-2025:3131
RHOSSM 2.5 for RHEL 8Fixed RHSA-2025:3922
Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9Fixed RHSA-2025:4666, RHSA-2025:4810
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9Fixed—
Red Hat Ceph Storage 7.1 ToolsFixed RHSA-2025:4667
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:7466, RHSA-2025:7592, RHSA-2025:9514
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:3772, RHSA-2026:66016
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:3335, RHSA-2025:3773, RHSA-2025:7326
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:90994, RHSA-2026:92217, RHSA-2026:95234
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:69235, RHSA-2026:72805, RHSA-2026:87246, RHSA-2026:88339, RHSA-2026:88394, RHSA-2026:90725
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:4693, RHSA-2026:68504, RHSA-2026:72737, RHSA-2026:87245, RHSA-2026:88340, RHSA-2026:88395, RHSA-2026:90726
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:3593
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:90994, RHSA-2026:92217, RHSA-2026:95234
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:69235, RHSA-2026:72805, RHSA-2026:87246, RHSA-2026:88339, RHSA-2026:88394, RHSA-2026:90725
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:4693, RHSA-2026:68504, RHSA-2026:72737, RHSA-2026:87245, RHSA-2026:88340, RHSA-2026:88395, RHSA-2026:90726
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:7592
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:7326
Red Hat OpenShift distributed tracing 3.5.3Fixed RHSA-2025:2789
Red Hat Web Terminal 1.11Fixed RHSA-2026:94072
Red Hat Web Terminal 1.13Fixed RHSA-2026:94070
Red Hat Web Terminal 1.14Fixed RHSA-2026:94074
Satellite Client 6 for RHEL 8Fixed RHSA-2025:7624
Satellite Client 6 for RHEL 9Fixed RHSA-2025:7624
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:54432, RHSA-2026:59557
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:57194, RHSA-2026:59556
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:59579
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:59558
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:59559
Not affected: 34 products
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Multiarch Tuning Operator
  • Multicluster Engine for Kubernetes
  • OpenShift Developer Tools and Services
  • OpenShift Secondary Scheduler Operator
  • RHOSSM 2.5 for RHEL 8
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • Red Hat Ceph Storage 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 3.5.3
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Trusted Artifact Signer
  • Red Hat Web Terminal 1.11
  • Red Hat Web Terminal 1.13
  • Red Hat Web Terminal 1.14
  • Red Hat build of Apache Camel - HawtIO 4
  • Satellite Client 6 for RHEL 10
  • Satellite Client 6 for RHEL 8
  • Satellite Client 6 for RHEL 9
  • Service Telemetry Framework 1.5
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45336
  2. 2026-10-03 Alias added: GHSA-7wrw-r4p8-38rx
  3. 2026-10-08 Affected versions changed · Red Hat
  4. 2026-10-22 Fix available: RHSA-2026:87245 · Red Hat
  5. 2026-10-22 Fix available: RHSA-2026:87246 · Red Hat
  6. 2026-10-23 Fix available: RHSA-2026:88340 · Red Hat
  7. 2026-10-23 Fix available: RHSA-2026:88339 · Red Hat
  8. 2026-10-23 Fix available: RHSA-2026:88394 · Red Hat
  9. 2026-10-23 Fix available: RHSA-2026:88395 · Red Hat
  10. 2026-10-23 Affected versions changed · Red Hat
  11. 2026-10-27 Affected versions changed · Red Hat
  12. 2026-10-29 Fix available: RHSA-2026:90725 · Red Hat
  13. 2026-10-29 Fix available: RHSA-2026:90726 · Red Hat
  14. 2026-10-29 Fix available: RHSA-2026:90994 · Red Hat
  15. 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · Red Hat
  16. 2026-10-30 Fix available: RHSA-2026:92217 · Red Hat
  17. 2026-10-30 Affected versions changed · Red Hat
  18. 2026-11-03 Fix available: RHSA-2026:94074 · Red Hat
  19. 2026-11-03 Fix available: RHSA-2026:94072 · Red Hat
  20. 2026-11-03 Fix available: RHSA-2026:94070 · Red Hat
  21. 2026-11-03 Fix available: Red Hat Web Terminal 1.11, Red Hat Web Terminal 1.13, Red Hat Web Terminal 1.14 · Red Hat
  22. 2026-11-05 Affected versions changed · Red Hat
  23. 2026-11-06 Fix available: RHSA-2026:95234 · Red Hat

References

Other 5

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences