Read the docs
TI-2025-16738 Aliases CVE-2025-22866GHSA-3whm-j4xm-rv8x

Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

Priority LOW 19Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 26 fixed, 57 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0029 21st percentileScored 2026-11-07
Fix Partial crypto/internal/nistec (Go standard library): 1.22.12, 1.23.6, 1.24.0-rc.3Red Hat: 35 advisoriesRed Hat: 26 fixed, 57 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarycrypto/internal/nistecbefore 1.22.12; 1.23.0-0 to before 1.23.6; 1.24.0-0 to before 1.24.0-rc.31.22.12, 1.23.6, 1.24.0-rc.3Patch availableCNA
  • crypto/internal/nistec VendorGo standard library Affected before 1.22.12; 1.23.0-0 to before 1.23.6; 1.24.0-0 to before 1.24.0-rc.3 Fixed in 1.22.12, 1.23.6, 1.24.0-rc.3 Patch available CNA

Remediation

  • Fix · CNA crypto/internal/nistec (Go standard library) Fixed in 1.22.12, 1.23.6, 1.24.0-rc.3

Red Hat 35 advisories

  • RHSA-2026:95234 Released 2026-11-04 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) git-lfs-2.13.3-3.el8_4.6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) git-lfs-2.13.3-3.el8_4.6
  • RHSA-2026:94074 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.14.2 release.
    • Red Hat Web Terminal 1.14 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94072 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.11.3 release.
    • Red Hat Web Terminal 1.11 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
Show 32 more Red Hat advisories
  • RHSA-2026:94070 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.13.2 release.
    • Red Hat Web Terminal 1.13 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:90994 Released 2026-10-27 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:88395 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) grafana-pcp-3.2.0-6.el8_8.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) grafana-pcp-3.2.0-6.el8_8.2
  • RHSA-2026:88394 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) grafana-pcp-3.2.0-4.el8_6.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) grafana-pcp-3.2.0-4.el8_6.2
  • RHSA-2026:88340 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) grafana-7.5.15-12.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) grafana-7.5.15-12.el8_8
  • RHSA-2026:88339 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) grafana-7.5.11-12.el8_6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) grafana-7.5.11-12.el8_6
  • RHSA-2026:87245 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8 +13
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.8.0+25113+a148ecc0.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:87246 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:72854 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.11 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +8
  • RHSA-2026:72805 Released 2026-09-28 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) git-lfs-2.13.3-3.el8_6.8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) git-lfs-2.13.3-3.el8_6.8
  • RHSA-2026:72737 Released 2026-09-28 · Red Hat rating Important
    git-lfs security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) git-lfs-3.2.0-2.el8_8.8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) git-lfs-3.2.0-2.el8_8.8
  • RHSA-2026:69235 Released 2026-09-21 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) osbuild-composer-46.3-8.el8_6, osbuild-composer-core-46.3-8.el8_6, osbuild-composer-dnf-json-46.3-8.el8_6 +1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) osbuild-composer-46.3-8.el8_6, osbuild-composer-core-46.3-8.el8_6, osbuild-composer-dnf-json-46.3-8.el8_6 +1
  • RHSA-2026:68504 Released 2026-09-17 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) osbuild-composer-75-10.el8_8, osbuild-composer-core-75-10.el8_8, osbuild-composer-dnf-json-75-10.el8_8 +1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) osbuild-composer-75-10.el8_8, osbuild-composer-core-75-10.el8_8, osbuild-composer-dnf-json-75-10.el8_8 +1
  • RHSA-2026:67148 Released 2026-09-14 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-101.5-3.el8_10, osbuild-composer-core-101.5-3.el8_10, osbuild-composer-worker-101.5-3.el8_10
  • RHSA-2026:59579 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.14 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +17
  • RHSA-2026:59559 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.7 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +15
  • RHSA-2026:59558 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.10 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9 +20
  • RHSA-2026:59557 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.6 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +16
  • RHSA-2026:59556 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.6 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +14
  • RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.5 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
  • RHSA-2026:54432 Released 2026-08-12 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.5 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +1
  • RHSA-2026:4693 Released 2026-03-17 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8, buildah-1:1.29.7-1.module+el8.8.0+24026+ca15dd94.src::container-tools:rhel8 +47
  • RHSA-2025:8761 Released 2025-06-10 · Red Hat rating Important
    HawtIO 4.2.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO HawtIO 4.2.0
  • RHSA-2025:8670 Released 2025-06-09 · Red Hat rating Moderate
    Release of OpenShift Serverless Logic 1.36.0 security update & enhancements
    • 8Base-Openshift-Serverless-1.36 openshift-serverless-1/logic-data-index-ephemeral-rhel8, openshift-serverless-1/logic-data-index-postgresql-rhel8, openshift-serverless-1/logic-db-migrator-tool-rhel8 +6
  • RHSA-2025:7466 Released 2025-05-13 · Red Hat rating Moderate
    delve and golang security update
    • Red Hat Enterprise Linux AppStream (v. 10) delve-1.24.1-1.el10_0, go-toolset-1.23.7-1.el10_0, golang-1.23.7-1.el10_0 +5
  • RHSA-2025:7326 Released 2025-05-13 · Red Hat rating Moderate
    rhc security update
    • Red Hat Enterprise Linux AppStream (v. 9) rhc-1:0.2.6-3.el9_6
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) rhc-devel-1:0.2.6-3.el9_6
  • RHSA-2025:4810 Released 2025-05-12 · Red Hat rating Important
    RHSA: Submariner 0.18.5 - bug and security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/lighthouse-agent-rhel9, rhacm2/lighthouse-coredns-rhel9, rhacm2/nettest-rhel9 +6
  • RHSA-2025:4666 Released 2025-05-07 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.11.7 container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/acm-grafana-rhel9, rhacm2/acm-prometheus-config-reloader-rhel9, rhacm2/acm-prometheus-rhel9 +16
  • RHSA-2025:4667 Released 2025-05-07 · Red Hat rating Moderate
    Updated 7.1 container image is now available in the Red Hat Ecosystem Catalog.
    • Red Hat Ceph Storage 7.1 Tools rhceph/grafana-rhel9, rhceph/keepalived-rhel9, rhceph/rhceph-7-rhel9 +3
  • RHSA-2025:3922 Released 2025-04-15 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh Containers for 2.5.10
    • RHOSSM 2.5 for RHEL 8 openshift-service-mesh/kiali-rhel8
  • RHSA-2025:3773 Released 2025-04-10 · Red Hat rating Important
    delve and golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) delve-1.24.1-2.el9_5, go-toolset-1.23.6-2.el9_5, golang-1.23.6-2.el9_5 +6
  • RHSA-2025:2789 Released 2025-03-13 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.5.0 release
    • Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/opentelemetry-collector-rhel8, registry.redhat.io/rhosdt/opentelemetry-rhel8-operator, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Builds for Red Hat OpenShiftAffectedNo fix yet
Confidential Compute AttestationAffectedNo fix yet
Cryostat 3AffectedNo fix yet: Fix deferred
Deployment Validation OperatorAffectedNo fix yet
Fence Agents Remediation OperatorAffectedNo fix yet: Fix deferred
Kube Descheduler OperatorAffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
Machine Deletion Remediation OperatorAffectedNo fix yet: Fix deferred
Migration Toolkit for Applications 7AffectedNo fix yet: Fix deferred
Migration Toolkit for ContainersAffectedNo fix yet: Fix deferred
Migration Toolkit for VirtualizationAffectedNo fix yet: Fix deferred
Multiarch Tuning OperatorAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
NBDE Tang ServerAffectedNo fix yet
Network Observability OperatorAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet: Fix deferred
Node Maintenance OperatorAffectedNo fix yet: Fix deferred
OpenShift API for Data ProtectionAffectedNo fix yet: Fix deferred
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift Run Once Duration Override OperatorAffectedNo fix yet
OpenShift Secondary Scheduler OperatorAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix yet: Fix deferred
OpenShift Service Mesh 3AffectedNo fix yet: Fix deferred
OpenShift Source-to-Image (S2I)AffectedNo fix yet: Fix deferred
Power monitoring for Red Hat OpenShiftAffectedNo fix yet: Fix deferred
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 1.2AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Cluster Manager CLIAffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet: Fix deferred
Red Hat Openshift Sandboxed ContainersAffectedNo fix yet: Fix deferred
Red Hat Quay 3AffectedNo fix yet: Fix deferred
Red Hat Runtimes Inventory OperatorAffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Service Interconnect 1AffectedNo fix yet: Fix deferred
Red Hat Storage 3AffectedNo fix yet
Red Hat Web TerminalAffectedNo fix yet
Self Node Remediation OperatorAffectedNo fix yet: Fix deferred
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
8Base-Openshift-Serverless-1.36Fixed RHSA-2025:8670
HawtIO HawtIO 4.2.0Fixed RHSA-2025:8761
RHOSSM 2.5 for RHEL 8Fixed RHSA-2025:3922
Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9Fixed RHSA-2025:4666, RHSA-2025:4810
Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9Fixed—
Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9Fixed RHSA-2025:16113
Red Hat Ceph Storage 7.1 ToolsFixed RHSA-2025:4667
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:7466
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:67148
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:3773, RHSA-2025:7326
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:90994, RHSA-2026:95234
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:69235, RHSA-2026:72805, RHSA-2026:87246, RHSA-2026:88339, RHSA-2026:88394
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:4693, RHSA-2026:68504, RHSA-2026:72737, RHSA-2026:87245, RHSA-2026:88340, RHSA-2026:88395
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:90994, RHSA-2026:95234
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:69235, RHSA-2026:72805, RHSA-2026:87246, RHSA-2026:88339, RHSA-2026:88394
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:4693, RHSA-2026:68504, RHSA-2026:72737, RHSA-2026:87245, RHSA-2026:88340, RHSA-2026:88395
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:7326
Red Hat OpenShift distributed tracing 3.5.3Fixed RHSA-2025:2789
Red Hat Web Terminal 1.11Fixed RHSA-2026:94072
Red Hat Web Terminal 1.13Fixed RHSA-2026:94070
Red Hat Web Terminal 1.14Fixed RHSA-2026:94074
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:54432, RHSA-2026:59557
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:57194, RHSA-2026:59556
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:59579
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:59558, RHSA-2026:72854
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:59559
Not affected: 30 products
  • 8Base-Openshift-Serverless-1.36
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Logical Volume Manager Storage
  • Multicluster Engine for Kubernetes
  • OpenShift Developer Tools and Services
  • RHOSSM 2.5 for RHEL 8
  • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • Red Hat Ceph Storage 8
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 3.5.3
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Satellite 6
  • Red Hat Trusted Artifact Signer
  • Red Hat Web Terminal 1.11
  • Red Hat Web Terminal 1.13
  • Red Hat Web Terminal 1.14
  • Service Telemetry Framework 1.5
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-22866
  2. 2026-10-03 Alias added: GHSA-3whm-j4xm-rv8x
  3. 2026-10-08 Affected versions changed · Red Hat
  4. 2026-10-22 Fix available: RHSA-2026:87245 · Red Hat
  5. 2026-10-22 Fix available: RHSA-2026:87246 · Red Hat
  6. 2026-10-23 Fix available: RHSA-2026:88340 · Red Hat
  7. 2026-10-23 Fix available: RHSA-2026:88339 · Red Hat
  8. 2026-10-23 Fix available: RHSA-2026:88394 · Red Hat
  9. 2026-10-23 Fix available: RHSA-2026:88395 · Red Hat
  10. 2026-10-23 Affected versions changed · Red Hat
  11. 2026-10-29 Fix available: RHSA-2026:90994 · Red Hat
  12. 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · Red Hat
  13. 2026-11-03 Fix available: RHSA-2026:94074 · Red Hat
  14. 2026-11-03 Fix available: RHSA-2026:94072 · Red Hat
  15. 2026-11-03 Fix available: RHSA-2026:94070 · Red Hat
  16. 2026-11-03 Fix available: Red Hat Web Terminal 1.11, Red Hat Web Terminal 1.13, Red Hat Web Terminal 1.14 · Red Hat
  17. 2026-11-05 Affected versions changed · Red Hat
  18. 2026-11-06 Fix available: RHSA-2026:95234 · Red Hat
  19. 2026-11-06 Affected versions changed · Red Hat

References

Other 4

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences