Read the docs
TI-2026-28711 Aliases CVE-2026-39829GHSA-w879-237q-wc7r

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

Priority LOW 39CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 63 fixed, 20 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-347.

Summary

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00467 40th percentileScored 2026-11-07
Fix Partial golang.org/x/crypto/ssh (golang.org/x/crypto): 0.52.0golang.org/x/crypto (Go): 0.52.0Red Hat: 104 advisoriesRed Hat: 63 fixed, 20 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarygolang.org/x/crypto/sshbefore 0.52.00.52.0Patch availableCNA
—golang.org/x/crypto (Go)before 0.52.00.52.0Patch availableGHSA-w879-237q-wc7r
  • golang.org/x/crypto/ssh VendorGo standard library Affected before 0.52.0 Fixed in 0.52.0 Patch available CNA
  • golang.org/x/crypto (Go) Vendor— Affected before 0.52.0 Fixed in 0.52.0 Patch available GHSA-w879-237q-wc7r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:*before 0.52.0VulnerableGo standard library
  • cpe:2.3:a:golang:crypto:*:*:*:*:*:go:*:* Versions before 0.52.0 Vulnerable ·Go standard library

Remediation

  • Fix · CNA golang.org/x/crypto/ssh (golang.org/x/crypto) Fixed in 0.52.0
  • Fix · GHSA-w879-237q-wc7r golang.org/x/crypto (Go) Fixed in 0.52.0 Advisory →

Red Hat 104 advisories

  • RHSA-2026:91640 Released 2026-10-28 · Red Hat rating Important
    OpenShift Container Platform 4.16 CNF IBU extras update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator
  • RHSA-2026:91635 Released 2026-10-28 · Red Hat rating Important
    OpenShift Container Platform 4.14 CNF IBU extras update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator
  • RHSA-2026:90274 Released 2026-10-27 · Red Hat rating Important
    OpenShift Container Platform 4.12.102 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
Show 101 more Red Hat advisories
  • RHSA-2026:89715 Released 2026-10-27 · Red Hat rating Important
    OpenShift Container Platform 4.16.74 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:89626 Released 2026-10-26 · Red Hat rating Important
    OpenShift Container Platform 4.21.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:82785 Released 2026-10-22 · Red Hat rating Important
    OpenShift Container Platform 4.14.76 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel8, registry.redhat.io/openshift4/ose-baremetal-rhel8-operator +9
  • RHSA-2026:82813 Released 2026-10-22 · Red Hat rating Important
    OpenShift Container Platform 4.15.70 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kube-metrics-server-rhel8, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel9 +23
  • RHSA-2026:79039 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.18.57 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9 +18
  • RHSA-2026:77552 Released 2026-10-15 · Red Hat rating Important
    OpenShift Container Platform 4.17.59 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9 +12
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:82055 Released 2026-10-13 · Red Hat rating Important
    OpenShift Container Platform 4.18 CNF IBU extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator
  • RHSA-2026:80684 Released 2026-10-12 · Red Hat rating Important
    Updated Red Hat OpenStack Platform 17.1 director Operator container images
    • Red Hat OpenStack Platform 17.1 registry.redhat.io/rhosp-rhel9/osp-director-operator
  • RHSA-2026:73853 Released 2026-10-08 · Red Hat rating Important
    OpenShift Container Platform 4.16.72 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-node-agent-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9-operator +17
  • RHSA-2026:74434 Released 2026-10-07 · Red Hat rating Important
    OpenShift Container Platform 4.19.50 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-baremetal-installer-rhel9 +7
  • RHSA-2026:74380 Released 2026-10-06 · Red Hat rating Important
    OpenShift Container Platform 4.20.41 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +12
  • RHSA-2026:76814 Released 2026-10-06 · Red Hat rating Important
    OpenShift Container Platform 4.19 CNF IBU extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator
  • RHSA-2026:76752 Released 2026-10-06 · Red Hat rating Important
    OpenShift Security Profiles Operator bug fix and enhancement update
    • OpenShift Security Profiles Operator 1 registry.redhat.io/compliance/openshift-security-profiles-operator-bundle, registry.redhat.io/compliance/openshift-security-profiles-rhel8-operator, registry.redhat.io/compliance/openshift-selinuxd-rhel8
  • RHSA-2026:74023 Released 2026-09-30 · Red Hat rating Important
    OpenShift Container Platform 4.21 CNF IBU extras update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:71450 Released 2026-09-29 · Red Hat rating Important
    OpenShift Container Platform 4.20.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:71453 Released 2026-09-29 · Red Hat rating Important
    OpenShift Container Platform 4.21.35 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:72851 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.8 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +7
  • RHSA-2026:72508 Released 2026-09-28 · Red Hat rating Important
    OpenShift Container Platform 4.20 CNF IBU extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator
  • RHSA-2026:70870 Released 2026-09-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.5.3
    • Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:68541 Released 2026-09-22 · Red Hat rating Important
    OpenShift Container Platform 4.20.39 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator, registry.redhat.io/openshift4/ose-csi-external-resizer-rhel9 +10
  • RHSA-2026:69922 Released 2026-09-22 · Red Hat rating Important
    OpenShift Container Platform 4.22 CNF IBU extras update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/lifecycle-agent-rhel9-operator
  • RHSA-2026:65852 Released 2026-09-17 · Red Hat rating Important
    OpenShift Container Platform 4.18.55 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9 +19
  • RHSA-2026:66352 Released 2026-09-15 · Red Hat rating Important
    OpenShift Container Platform 4.21.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:67450 Released 2026-09-14 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) podman-5:5.4.0-22.el9_6.5, podman-docker-5:5.4.0-22.el9_6.5, podman-plugins-5:5.4.0-22.el9_6.5 +2
  • RHSA-2026:66022 Released 2026-09-09 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +4
  • RHSA-2026:65964 Released 2026-09-09 · Red Hat rating Important
    Updated Red Hat OpenStack Platform 16.2 director Operator container images
    • Red Hat OpenStack Platform 16.2 registry.redhat.io/rhosp-rhel8/osp-director-operator
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:60454 Released 2026-09-02 · Red Hat rating Important
    OpenShift Container Platform 4.19.45 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9, registry.redhat.io/openshift4/ose-cli-artifacts-rhel9, registry.redhat.io/openshift4/ose-cluster-kube-scheduler-rhel9-operator +12
  • RHSA-2026:60446 Released 2026-09-01 · Red Hat rating Important
    OpenShift Container Platform 4.20.36 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-azure-cluster-api-controllers-rhel9 +18
  • RHSA-2026:60477 Released 2026-09-01 · Red Hat rating Important
    OpenShift Container Platform 4.21.31 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9 +20
  • RHSA-2026:61314 Released 2026-08-31 · Red Hat rating Important
    Cluster Observability Operator 1.5.2
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:59593 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.17.2 security update
    • multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +6
  • RHSA-2026:59559 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.7 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +15
  • RHSA-2026:59467 Released 2026-08-25 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +3
  • RHSA-2026:57365 Released 2026-08-25 · Red Hat rating Important
    OpenShift Container Platform 4.22.11 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/oc-mirror-plugin-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +6
  • RHSA-2026:57801 Released 2026-08-25 · Red Hat rating Important
    OpenShift Container Platform 4.21.30 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +2
  • RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.5 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
  • RHSA-2026:57191 Released 2026-08-19 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
  • RHSA-2026:54432 Released 2026-08-12 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.5 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/clusterclaims-controller-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +1
  • RHSA-2026:54400 Released 2026-08-12 · Red Hat rating Important
    VolSync v0.15 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/volsync-rhel9
  • RHSA-2026:54395 Released 2026-08-12 · Red Hat rating Important
    Red Hat Quay 3.17.4
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:52910 Released 2026-08-10 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.20.6 security update
    • Red Hat OpenShift GitOps 1.20 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/dex-rhel9
  • RHSA-2026:52857 Released 2026-08-10 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.19.6 security update
    • Red Hat OpenShift GitOps 1.19 registry.redhat.io/openshift-gitops-1/argocd-rhel8, registry.redhat.io/openshift-gitops-1/dex-rhel8, registry.redhat.io/openshift-gitops-1/gitops-rhel8-operator
  • RHSA-2026:51033 Released 2026-08-06 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:50888 Released 2026-08-05 · Red Hat rating Important
    RHTAS 1.4.3 - CLI Stack Release
    • Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
  • RHSA-2026:48693 Released 2026-08-04 · Red Hat rating Critical
    OpenShift Container Platform 4.22.8 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-installer-artifacts-rhel9 +2
  • RHSA-2026:49944 Released 2026-08-04 · Red Hat rating Important
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.src::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+23884+2031fc78.x86_64::container-tools:rhel8, buildah-1:1.29.8-1.module+el8.8.0+24545+b713e821.src::container-tools:rhel8 +47
  • RHSA-2026:49767 Released 2026-08-03 · Red Hat rating Important
    RHTAS 1.4.3 - CLI Stack Release
    • Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
  • RHSA-2026:48771 Released 2026-07-30 · Red Hat rating Important
    RHTAS 1.4.3 - CLI Stack Release
    • Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
  • RHSA-2026:48151 Released 2026-07-29 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:47949 Released 2026-07-29 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.6.13 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +2
  • RHSA-2026:47735 Released 2026-07-29 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.8.9 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9 +5
  • RHSA-2026:47451 Released 2026-07-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:47388 Released 2026-07-28 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.10.4 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:46903 Released 2026-07-27 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:46885 Released 2026-07-27 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.10.4 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:43692 Released 2026-07-22 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.6 registry.redhat.io/oadp/oadp-velero-rhel9
  • RHSA-2026:43052 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.12.20
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:42796 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.15.6
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:42146 Released 2026-07-20 · Red Hat rating Important
    Red Hat Quay 3.12.20
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:41066 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.16.5
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:41055 Released 2026-07-16 · Red Hat rating Important
    multicluster engine for Kubernetes v2.6.12 security update
    • multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator
  • RHSA-2026:41036 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Builds 1.8.1
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +6
  • RHSA-2026:41031 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.10.24
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:41019 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • RHEM 1.1 for RHEL 10 flightctl-1.1.3-1.el10em, flightctl-agent-1.1.3-1.el10em, flightctl-cli-1.1.3-1.el10em
    • RHEM 1.1 for RHEL 9 flightctl-1.1.3-1.el9em, flightctl-agent-1.1.3-1.el9em, flightctl-cli-1.1.3-1.el9em
  • RHSA-2026:40974 Released 2026-07-16 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:40972 Released 2026-07-16 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
  • RHSA-2026:40969 Released 2026-07-16 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/rekor-monitor-rhel9
  • RHSA-2026:40945 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:40262 Released 2026-07-15 · Red Hat rating Important
    Red Hat Quay 3.9.24
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:40118 Released 2026-07-15 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:37387 Released 2026-07-09 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
  • RHSA-2026:37296 Released 2026-07-09 · Red Hat rating Important
    RHTAS 1.0.1 - GA Release Of the Policy Controller Operator
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/policy-controller-rhel9-operator
  • RHSA-2026:37286 Released 2026-07-09 · Red Hat rating Important
    RHTAS 1.4.2 - Tech Preview Release Of the Model Validation Operator
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-validation-rhel9-operator
  • RHSA-2026:37278 Released 2026-07-09 · Red Hat rating Important
    RHTAS 1.4.2 - Tech Preview Release Of the Go based Model Transparency CLI
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/model-transparency-cli-rhel9
  • RHSA-2026:37276 Released 2026-07-09 · Red Hat rating Important
    RHTAS 1.4.2 - CLI Stack Release
    • Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
  • RHSA-2026:37272 Released 2026-07-09 · Red Hat rating Important
    RHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:37271 Released 2026-07-09 · Red Hat rating Important
    RHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
  • RHSA-2026:37268 Released 2026-07-09 · Red Hat rating Important
    RHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/ctlog-monitor-rhel9, registry.redhat.io/rhtas/rekor-monitor-rhel9
  • RHSA-2026:37123 Released 2026-07-09 · Red Hat rating Important
    podman security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-6:5.8.2-4.el9_8, podman-docker-6:5.8.2-4.el9_8, podman-plugins-6:5.8.2-4.el9_8 +2
  • RHSA-2026:37072 Released 2026-07-09 · Red Hat rating Important
    podman security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) podman-7:5.8.2-4.el10_2, podman-docker-7:5.8.2-4.el10_2, podman-remote-7:5.8.2-4.el10_2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests-7:5.8.2-4.el10_2
  • RHSA-2026:36883 Released 2026-07-08 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.5 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator
  • RHSA-2026:36820 Released 2026-07-08 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.29.0 Release.
    • Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6
  • RHSA-2026:36808 Released 2026-07-08 · Red Hat rating Important
    DevWorkspace Operator 0.42.0 release.
    • DevWorkspace Operator 0.42 registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9, registry.redhat.io/devworkspace/devworkspace-rhel9-operator
  • RHSA-2026:36796 Released 2026-07-08 · Red Hat rating Important
    Red Hat Edge Manager Version 1.0.3 Security Update
    • RHEM 1.0 for RHEL 9 flightctl-1.0.3-1.el9em, flightctl-agent-1.0.3-1.el9em, flightctl-cli-1.0.3-1.el9em +1
  • RHSA-2026:36797 Released 2026-07-08 · Red Hat rating Important
    RHTAS 1.4.2 - CLI Stack Release
    • Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
  • RHSA-2026:36651 Released 2026-07-08 · Red Hat rating Important
    Red Hat Edge Manager Version 1.0.3 Security Update
    • Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
  • RHSA-2026:36648 Released 2026-07-08 · Red Hat rating Important
    Red Hat OpenShift Builds 1.7.4
    • Red Hat OpenShift Builds 1.7.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +4
  • RHSA-2026:36625 Released 2026-07-08 · Red Hat rating Important
    RHACS 4.10.5 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2026:36319 Released 2026-07-07 · Red Hat rating Important
    RHACS 4.9.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2026:36199 Released 2026-07-07 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 10) buildah-2:1.43.1-3.el10_2, buildah-tests-2:1.43.1-3.el10_2
  • RHSA-2026:36207 Released 2026-07-07 · Red Hat rating Important
    RHACS 4.11.1 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator +4
  • RHSA-2026:35833 Released 2026-07-06 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+24482+e50f4e4f.s390x::container-tools:rhel8 +47
  • RHSA-2026:29455 Released 2026-06-25 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-2:1.43.1-2.el9_8, buildah-tests-2:1.43.1-2.el9_8
  • RHSA-2026:26547 Released 2026-06-17 · Red Hat rating Important
    RHACS 4.10.4 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1
  • RHSA-2026:26546 Released 2026-06-17 · Red Hat rating Important
    RHACS 4.9.8 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    golang.org/x/crypto/ssh 0.52.0

    9 records Highest priority Priority MEDIUM 4 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-34255 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/sshPriority MEDIUM 50
    • TI-2026-28713 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/sshPriority MEDIUM 48
    • TI-2026-28716 Invoking infinite loop on large channel writes in golang.org/x/crypto/sshPriority MEDIUM 46
    Show all 9 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Confidential Compute AttestationAffectedNo fix planned: Will not fix
External Secrets Operator for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift API for Data ProtectionAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift for Windows ContainersAffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix yet
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Zero Trust Workload Identity ManagerAffectedNo fix yet
Zero Trust Workload Identity Manager - Tech PreviewAffectedNo fix planned: Will not fix
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82304, RHSA-2026:82322
Cluster Observability Operator 1.5Fixed RHSA-2026:61314
Cryostat 4 on RHEL 9Fixed RHSA-2026:48151
DevWorkspace Operator 0.42Fixed RHSA-2026:36808
Logging Subsystem for Red Hat OpenShift 6.5Fixed RHSA-2026:70870
OpenShift API for Data Protection 1.3Fixed RHSA-2026:51033
OpenShift API for Data Protection 1.4Fixed RHSA-2026:59467
OpenShift API for Data Protection 1.5Fixed RHSA-2026:66022
OpenShift API for Data Protection 1.6Fixed RHSA-2026:43692
OpenShift Security Profiles Operator 1Fixed RHSA-2026:76752
RHEM 1.0 for RHEL 9Fixed RHSA-2026:36796
RHEM 1.1 for RHEL 10Fixed RHSA-2026:41019
RHEM 1.1 for RHEL 9Fixed RHSA-2026:41019
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:46903
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:54400, RHSA-2026:57191
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:26546, RHSA-2026:36319
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:36207
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:26547, RHSA-2026:36625
Red Hat Edge Manager 1.0Fixed RHSA-2026:36651
Red Hat Edge Manager 1.1Fixed RHSA-2026:40118, RHSA-2026:40945
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:36199, RHSA-2026:37072
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:35833
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:29455, RHSA-2026:37123
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:49944
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:67450
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:49944
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:37072
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520
Red Hat OpenShift Builds 1.7.3Fixed RHSA-2026:36648
Red Hat OpenShift Builds 1.8.3Fixed RHSA-2026:41036
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:90274
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:82785, RHSA-2026:91635
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:82813
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:73853, RHSA-2026:89715, RHSA-2026:91640
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:77552
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:65852, RHSA-2026:79039, RHSA-2026:82055
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:60454, RHSA-2026:74434, RHSA-2026:76814
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:60446, RHSA-2026:68541, RHSA-2026:71450, RHSA-2026:72508, RHSA-2026:74380
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:57801, RHSA-2026:60477, RHSA-2026:66352, RHSA-2026:71453, RHSA-2026:74023, RHSA-2026:89626
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:48693, RHSA-2026:57365, RHSA-2026:69922
Red Hat OpenShift Dev Spaces 3.29Fixed RHSA-2026:36820
Red Hat OpenShift GitOps 1.19Fixed RHSA-2026:52857
Red Hat OpenShift GitOps 1.20Fixed RHSA-2026:52910
Red Hat OpenStack Platform 16.2Fixed RHSA-2026:65964
Red Hat OpenStack Platform 17.1Fixed RHSA-2026:80684
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:37387
Red Hat Quay 3.10Fixed RHSA-2026:41031
Red Hat Quay 3.12Fixed RHSA-2026:42146, RHSA-2026:43052
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:42796
Red Hat Quay 3.16Fixed RHSA-2026:41066
Red Hat Quay 3.17Fixed RHSA-2026:54395
Red Hat Quay 3.9Fixed RHSA-2026:40262
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:40969, RHSA-2026:40972, RHSA-2026:40974
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:36797, RHSA-2026:37268, RHSA-2026:37271, RHSA-2026:37272, RHSA-2026:37278, RHSA-2026:37286, RHSA-2026:37296, RHSA-2026:48771
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:46885, RHSA-2026:54432
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:57194
multicluster engine for Kubernetes 2.17Fixed RHSA-2026:59593
multicluster engine for Kubernetes 2.6Fixed RHSA-2026:41055, RHSA-2026:47949
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:47735
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:36883, RHSA-2026:59559, RHSA-2026:72851
Not affected: 67 products
  • Cluster Observability Operator 1.5
  • Cryostat 4 on RHEL 9
  • DevWorkspace Operator 0.42
  • ExternalDNS Operator
  • Logging Subsystem for Red Hat OpenShift 6.5
  • OpenShift API for Data Protection
  • OpenShift API for Data Protection 1.3
  • OpenShift API for Data Protection 1.4
  • OpenShift API for Data Protection 1.5
  • OpenShift API for Data Protection 1.6
  • OpenShift Security Profiles Operator 1
  • RHEM 1.0 for RHEL 9
  • RHEM 1.1 for RHEL 10
  • RHEM 1.1 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Edge Manager 1.0
  • Red Hat Edge Manager 1.1
  • Red Hat Enterprise Linux 10
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Builds 1.7.3
  • Red Hat OpenShift Builds 1.8.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.29
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.19
  • Red Hat OpenShift GitOps 1.20
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift for Windows Containers
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Data Foundation 4.22
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.9
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat Trusted Artifact Signer 1.4
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.17
  • multicluster engine for Kubernetes 2.6
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39829
  2. 2026-10-03 Alias added: GHSA-w879-237q-wc7r
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-07 Fix available: RHSA-2026:74380 · Red Hat
  5. 2026-10-07 Fix available: RHSA-2026:76814 · Red Hat
  6. 2026-10-07 Affected versions changed · Red Hat
  7. 2026-10-07 Fix available: RHSA-2026:76752 · Red Hat
  8. 2026-10-07 Fix available: RHSA-2026:74434 · Red Hat
  9. 2026-10-07 Fix available: OpenShift Security Profiles Operator 1 · Red Hat
  10. 2026-10-09 Fix available: RHSA-2026:73853 · Red Hat
  11. 2026-10-09 Fix available: Red Hat OpenShift Container Platform 4.16 · Red Hat
  12. 2026-10-13 Fix available: RHSA-2026:80684 · Red Hat
  13. 2026-10-13 Fix available: RHSA-2026:82055 · Red Hat
  14. 2026-10-13 Fix available: Red Hat OpenStack Platform 17.1 · Red Hat
  15. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
  16. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  17. 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat
  18. 2026-10-16 Fix available: RHSA-2026:77552 · Red Hat
  19. 2026-10-16 Fix available: RHSA-2026:79039 · Red Hat
  20. 2026-10-16 Fix available: Red Hat OpenShift Container Platform 4.17 · Red Hat
  21. 2026-10-22 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
  22. 2026-10-23 Fix available: RHSA-2026:82813 · Red Hat
  23. 2026-10-23 Fix available: RHSA-2026:82785 · Red Hat
  24. 2026-10-23 Fix available: Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15 · Red Hat
  25. 2026-10-23 Priority changed: MEDIUM → LOW
  26. 2026-10-25 Fix available: Red Hat OpenShift Builds 1.8.3 · Red Hat
  27. 2026-10-29 Fix available: Red Hat OpenShift Container Platform 4.12 · Red Hat
  28. 2026-10-30 Fix available: RHSA-2026:91635 · Red Hat
  29. 2026-10-30 Fix available: RHSA-2026:91640 · Red Hat
  30. 2026-10-30 Fix available: RHSA-2026:90274 · Red Hat
  31. 2026-10-30 Fix available: RHSA-2026:89626 · Red Hat
  32. 2026-10-30 Fix available: RHSA-2026:89715 · Red Hat
  33. 2026-10-30 Affected versions changed · Red Hat
  34. 2026-10-30 Affected versions changed · Red Hat
  35. 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  36. 2026-11-04 Fix available: Cluster Observability Operator 1.5, Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat

References

Advisory 2

Other 44

  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2026-30791 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts CVSS 3.1CRITICAL 9.1
  • TI-2026-34255 Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 10.0
  • TI-2026-28715 Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
  • TI-2026-28714 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent CVSS 3.1CRITICAL 9.1
  • TI-2026-28713 Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh CVSS 3.1CRITICAL 9.1
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences