Read the docs
TI-2026-30782 Aliases CVE-2026-42499GHSA-xq5j-9r39-c3vf

Quadratic string concatenation in consumePhrase in net/mail

Priority MEDIUM 40Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 78 fixed, 43 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00798 56th percentileScored 2026-11-07
Fix Partial net/mail (Go standard library): 1.25.10, 1.26.3Red Hat: 127 advisoriesRed Hat: 78 fixed, 43 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarynet/mailbefore 1.25.10; 1.26.0-0 to before 1.26.31.25.10, 1.26.3Patch availableCNA
  • net/mail VendorGo standard library Affected before 1.25.10; 1.26.0-0 to before 1.26.3 Fixed in 1.25.10, 1.26.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.25.10; 1.26.0 to before 1.26.3VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.25.10; 1.26.0 to before 1.26.3 Vulnerable ·Go standard library

Remediation

  • Fix · CNA net/mail (Go standard library) Fixed in 1.25.10, 1.26.3

Red Hat 127 advisories

  • RHSA-2026:95612 Released 2026-11-05 · Red Hat rating Important
    OpenShift Compliance Operator bug fix and enhancement update
    • OpenShift Compliance Operator 1 registry.redhat.io/compliance/openshift-compliance-rhel8-operator
  • RHSA-2026:92593 Released 2026-10-29 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.2
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2
  • RHSA-2026:92515 Released 2026-10-29 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.2
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2
Show 124 more Red Hat advisories
  • RHSA-2026:91249 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.5.5 (Neuron)
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:91248 Released 2026-10-27 · Red Hat rating Critical
    Red Hat AI Base Images 3.4.6 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:90994 Released 2026-10-27 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:90321 Released 2026-10-26 · Red Hat rating Critical
    Red Hat OpenShift Dev Spaces 3.31.0 Release.
    • Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
  • RHSA-2026:88340 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) grafana-7.5.15-12.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) grafana-7.5.15-12.el8_8
  • RHSA-2026:88339 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) grafana-7.5.11-12.el8_6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) grafana-7.5.11-12.el8_6
  • RHSA-2026:87245 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8 +13
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.8.0+25113+a148ecc0.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:87246 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:83013 Released 2026-10-14 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.17
    • Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:82372 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82354 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:82347 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.2
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:76795 Released 2026-10-06 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) grafana-9.2.10-28.el9_4, grafana-selinux-9.2.10-28.el9_4
  • RHSA-2026:76809 Released 2026-10-06 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) grafana-9.0.9-13.el9_2
  • RHSA-2026:76752 Released 2026-10-06 · Red Hat rating Important
    OpenShift Security Profiles Operator bug fix and enhancement update
    • OpenShift Security Profiles Operator 1 registry.redhat.io/compliance/openshift-security-profiles-operator-bundle, registry.redhat.io/compliance/openshift-security-profiles-rhel8-operator, registry.redhat.io/compliance/openshift-selinuxd-rhel8
  • RHSA-2026:74511 Released 2026-10-01 · Red Hat rating Important
    Red Hat Quay 3.17.5
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:73538 Released 2026-09-29 · Red Hat rating Important
    Red Hat Lightspeed (formerly Insights) for Runtimes security update
    • Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 registry.redhat.io/rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator
  • RHSA-2026:68534 Released 2026-09-23 · Red Hat rating Important
    OpenShift Container Platform 4.19.48 packages and security update
    • Red Hat OpenShift Container Platform 4.19 cri-o-1.32.13-14.rhaos4.19.git3c1400a.el9, openshift-4.19.0-202609141900.p2.g63adf01.assembly.stream.el9, openshift-clients-4.19.0-202609141900.p2.ga2c805b.assembly.stream.el8 +11
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:70201 Released 2026-09-22 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 10) podman-7:5.8.2-9.el10_2, podman-docker-7:5.8.2-9.el10_2, podman-remote-7:5.8.2-9.el10_2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) podman-tests-7:5.8.2-9.el10_2
  • RHSA-2026:68780 Released 2026-09-17 · Red Hat rating Critical
    Technical preview of the satellite/iop-vmaas-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
  • RHSA-2026:68764 Released 2026-09-17 · Red Hat rating Critical
    Technical preview of the satellite/iop-vmaas-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vmaas-rhel9
  • RHSA-2026:65838 Released 2026-09-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.71 packages and security update
    • Red Hat OpenShift Container Platform 4.13 containernetworking-plugins-1:1.4.0-8.rhaos4.13.el8, cri-o-1.26.5-32.rhaos4.13.git1088e36.el8, cri-o-1.26.5-32.rhaos4.13.git1088e36.el9 +14
  • RHSA-2026:68527 Released 2026-09-17 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) opentelemetry-collector-0.152.1-2.el9_4
  • RHSA-2026:65840 Released 2026-09-17 · Red Hat rating Important
    OpenShift Container Platform 4.13.71 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:68504 Released 2026-09-17 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) osbuild-composer-75-10.el8_8, osbuild-composer-core-75-10.el8_8, osbuild-composer-dnf-json-75-10.el8_8 +1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) osbuild-composer-75-10.el8_8, osbuild-composer-core-75-10.el8_8, osbuild-composer-dnf-json-75-10.el8_8 +1
  • RHSA-2026:68334 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • RHEM 1.1 for RHEL 10 flightctl-1.1.4-1.el10em, flightctl-agent-1.1.4-1.el10em, flightctl-cli-1.1.4-1.el10em
    • RHEM 1.1 for RHEL 9 flightctl-1.1.4-1.el9em, flightctl-agent-1.1.4-1.el9em, flightctl-cli-1.1.4-1.el9em
  • RHSA-2026:68253 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +10
  • RHSA-2026:67975 Released 2026-09-16 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) opentelemetry-collector-0.152.1-2.el9_6
  • RHSA-2026:67974 Released 2026-09-16 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) opentelemetry-collector-0.152.1-2.el10_0
  • RHSA-2026:68044 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:67517 Released 2026-09-15 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) grafana-10.2.6-26.el10_0, grafana-selinux-10.2.6-26.el10_0
  • RHSA-2026:67148 Released 2026-09-14 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 8) osbuild-composer-101.5-3.el8_10, osbuild-composer-core-101.5-3.el8_10, osbuild-composer-worker-101.5-3.el8_10
  • RHSA-2026:66327 Released 2026-09-10 · Red Hat rating Important
    osbuild-composer security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) osbuild-composer-134.1-12.el10_0, osbuild-composer-core-134.1-12.el10_0, osbuild-composer-worker-134.1-12.el10_0
  • RHSA-2026:66022 Released 2026-09-09 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +4
  • RHSA-2026:65886 Released 2026-09-09 · Red Hat rating Important
    image-builder security update
    • Red Hat Enterprise Linux AppStream (v. 9) image-builder-52.1-1.el9_8.2
  • RHSA-2026:65895 Released 2026-09-09 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 10) osbuild-composer-165.1-3.el10_2.2, osbuild-composer-core-165.1-3.el10_2.2, osbuild-composer-worker-165.1-3.el10_2.2
  • RHSA-2026:63636 Released 2026-09-09 · Red Hat rating Important
    Red Hat build of MicroShift 4.19.46 security update
    • Red Hat OpenShift Container Platform 4.19 microshift-4.19.46-202609041024.p0.g59e34c7.assembly.4.19.46.el9, microshift-ai-model-serving-4.19.46-202609041024.p0.g59e34c7.assembly.4.19.46.el9, microshift-ai-model-serving-release-info-4.19.46-202609041024.p0.g59e34c7.assembly.4.19.46.el9 +12
  • RHSA-2026:65534 Released 2026-09-08 · Red Hat rating Important
    image-builder security update
    • Red Hat Enterprise Linux AppStream (v. 10) image-builder-52.1-1.el10_2.2
  • RHSA-2026:65153 Released 2026-09-08 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream (v. 9) osbuild-composer-165.1-4.el9_8.1, osbuild-composer-core-165.1-4.el9_8.1, osbuild-composer-worker-165.1-4.el9_8.1
  • RHSA-2026:65336 Released 2026-09-08 · Red Hat rating Important
    ignition security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) ignition-2.21.0-7.el9_6.1, ignition-edge-2.21.0-7.el9_6.1, ignition-grub-2.21.0-7.el9_6.1 +1
  • RHSA-2026:65117 Released 2026-09-08 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.152.1-2.el9_8
  • RHSA-2026:65335 Released 2026-09-08 · Red Hat rating Important
    ignition security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) ignition-2.21.0-3.el10_0.4, ignition-edge-2.21.0-3.el10_0.4, ignition-validate-2.21.0-3.el10_0.4
  • RHSA-2026:65116 Released 2026-09-08 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector-0.152.1-2.el10_2
  • RHSA-2026:64818 Released 2026-09-08 · Red Hat rating Important
    skopeo security update
    • Red Hat Enterprise Linux AppStream (v. 10) skopeo-2:1.22.2-5.el10_2, skopeo-tests-2:1.22.2-5.el10_2
  • RHSA-2026:63163 Released 2026-09-04 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.1-2.module+el8.10.0+24790+ef71b018.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+24790+ef71b018.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.1-2.module+el8.10.0+24790+ef71b018.s390x::container-tools:rhel8 +47
  • RHSA-2026:63332 Released 2026-09-04 · Red Hat rating Important
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 10) buildah-2:1.43.1-5.el10_2, buildah-tests-2:1.43.1-5.el10_2
  • RHSA-2026:59830 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.12.97 packages and security update
    • Red Hat OpenShift Container Platform 4.12 containernetworking-plugins-1:1.4.0-7.rhaos4.12.el8, cri-o-1.25.5-34.rhaos4.12.git6120b13.el8, cri-tools-1.25.0-6.el9 +13
  • RHSA-2026:59833 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.12.97 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:60018 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.17.57 packages and security update
    • Red Hat OpenShift Container Platform 4.17 cri-o-1.30.14-11.rhaos4.17.git1e2a16d.el8, cri-o-1.30.14-11.rhaos4.17.git1e2a16d.el9, cri-tools-1.30.0-9.el8 +25
  • RHSA-2026:60023 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.17.57 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9 +20
  • RHSA-2026:63022 Released 2026-09-03 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 10) grafana-10.2.6-28.el10_2.5, grafana-selinux-10.2.6-28.el10_2.5
  • RHSA-2026:62803 Released 2026-09-02 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) osbuild-composer-132.2-12.el9_6, osbuild-composer-core-132.2-12.el9_6, osbuild-composer-worker-132.2-12.el9_6
  • RHSA-2026:62753 Released 2026-09-02 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) osbuild-composer-101.3-4.el9_4.6, osbuild-composer-core-101.3-4.el9_4.6, osbuild-composer-worker-101.3-4.el9_4.6
  • RHSA-2026:62754 Released 2026-09-02 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) osbuild-composer-76.1-9.el9_2, osbuild-composer-core-76.1-9.el9_2, osbuild-composer-dnf-json-76.1-9.el9_2 +1
  • RHSA-2026:62406 Released 2026-09-02 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-23.el9_8.3, grafana-selinux-10.2.6-23.el9_8.3
  • RHSA-2026:62407 Released 2026-09-02 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-33.el8_10, grafana-selinux-9.2.10-33.el8_10
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:61253 Released 2026-08-31 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) go-toolset-1.26.5-1.el9_2, golang-1.26.5-1.el9_2, golang-bin-1.26.5-1.el9_2 +5
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:56910 Released 2026-08-26 · Red Hat rating Important
    OpenShift Container Platform 4.15.68 packages and security update
    • Red Hat OpenShift Container Platform 4.15 butane-0.20.0-6.rhaos4.15.el8, butane-redistributable-0.20.0-6.rhaos4.15.el8, containernetworking-plugins-1:1.4.0-7.rhaos4.15.el8 +18
  • RHSA-2026:56852 Released 2026-08-26 · Red Hat rating Important
    OpenShift Container Platform 4.16.69 packages and security update
    • Red Hat OpenShift Container Platform 4.16 butane-0.21.0-6.rhaos4.16.el8, butane-redistributable-0.21.0-6.rhaos4.16.el8, containernetworking-plugins-1:1.4.0-10.rhaos4.16.el8 +34
  • RHSA-2026:57482 Released 2026-08-26 · Red Hat rating Important
    OpenShift Container Platform 4.18.54 packages and security update
    • Red Hat OpenShift Container Platform 4.18 butane-0.23.0-5.rhaos4.18.el8, butane-redistributable-0.23.0-5.rhaos4.18.el8, cri-o-1.31.13-11.rhaos4.18.git817a650.el9 +27
  • RHSA-2026:56912 Released 2026-08-26 · Red Hat rating Critical
    OpenShift Container Platform 4.15.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-console +5
  • RHSA-2026:56854 Released 2026-08-26 · Red Hat rating Important
    OpenShift Container Platform 4.16.69 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:57487 Released 2026-08-26 · Red Hat rating Important
    OpenShift Container Platform 4.18.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator +2
  • RHSA-2026:57914 Released 2026-08-26 · Red Hat rating Important
    Red Hat build of MicroShift 4.18.54 security update
    • Red Hat OpenShift Container Platform 4.18 microshift-4.18.54-202608211117.p0.g8eb6c29.assembly.4.18.54.el9, microshift-gateway-api-4.18.54-202608211117.p0.g8eb6c29.assembly.4.18.54.el9, microshift-gateway-api-release-info-4.18.54-202608211117.p0.g8eb6c29.assembly.4.18.54.el9 +9
  • RHSA-2026:56785 Released 2026-08-26 · Red Hat rating Important
    OpenShift Container Platform 4.14.72 packages and security update
    • Red Hat OpenShift Container Platform 4.14 butane-0.19.0-5.rhaos4.14.el8, butane-redistributable-0.19.0-5.rhaos4.14.el8, cri-o-1.27.8-19.rhaos4.14.gitcea2db1.el8 +13
  • RHSA-2026:56789 Released 2026-08-26 · Red Hat rating Critical
    OpenShift Container Platform 4.14.72 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8 +5
  • RHSA-2026:57845 Released 2026-08-26 · Red Hat rating Important
    Red Hat build of MicroShift 4.16.69 security update
    • Red Hat OpenShift Container Platform 4.16 microshift-4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9, microshift-greenboot-4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9, microshift-multus-4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 +6
  • RHSA-2026:59467 Released 2026-08-25 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +3
  • RHSA-2026:57649 Released 2026-08-20 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) go-toolset-1.26.5-1.el9_4, golang-1.26.5-1.el9_4, golang-bin-1.26.5-1.el9_4 +5
  • RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.5 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
  • RHSA-2026:54552 Released 2026-08-19 · Red Hat rating Important
    OpenShift Container Platform 4.19.43 packages and security update
    • Red Hat OpenShift Container Platform 4.19 cri-o-1.32.13-9.rhaos4.19.git2100f27.el9, cri-tools-1.32.0-6.el9, openshift-4.19.0-202608111604.p2.g63adf01.assembly.stream.el9 +10
  • RHSA-2026:54555 Released 2026-08-19 · Red Hat rating Important
    OpenShift Container Platform 4.19.43 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:56340 Released 2026-08-18 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.5.2
    • Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:54583 Released 2026-08-18 · Red Hat rating Important
    OpenShift Container Platform 4.20.34 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-haproxy-router-rhel9 +2
  • RHSA-2026:54602 Released 2026-08-18 · Red Hat rating Important
    OpenShift Container Platform 4.21.29 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-cli-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-haproxy-router-rhel9 +6
  • RHSA-2026:54531 Released 2026-08-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.19.1
    • Cert Manager support for Red Hat OpenShift release 1.19 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:54287 Released 2026-08-12 · Red Hat rating Important
    Red Hat OpenShift Workload Availability Operator v0.12.1 security update
    • Red Hat OpenShift Workload Availability 0.12 registry.redhat.io/workload-availability/node-healthcheck-rhel9-operator
  • RHSA-2026:54286 Released 2026-08-12 · Red Hat rating Important
    Red Hat OpenShift Workload Availability Operator v0.3.1 security update
    • Red Hat OpenShift Workload Availability 0.3 registry.redhat.io/workload-availability/storage-based-remediation-rhel9-operator
  • RHSA-2026:54285 Released 2026-08-12 · Red Hat rating Important
    Red Hat OpenShift Workload Availability Operator v0.7.1 security update
    • Red Hat OpenShift Workload Availability 0.7 registry.redhat.io/workload-availability/machine-deletion-remediation-rhel9-operator
  • RHSA-2026:54284 Released 2026-08-12 · Red Hat rating Important
    Red Hat OpenShift Workload Availability Operator v0.13.1 security update
    • Red Hat OpenShift Workload Availability 0.13 registry.redhat.io/workload-availability/self-node-remediation-rhel9-operator
  • RHSA-2026:54283 Released 2026-08-12 · Red Hat rating Important
    Red Hat OpenShift Workload Availability v5.7.1 security update
    • Red Hat OpenShift Workload Availability 5.7 registry.redhat.io/workload-availability/node-maintenance-rhel9-operator
  • RHSA-2026:54274 Released 2026-08-12 · Red Hat rating Important
    Red Hat OpenShift Workload Availability Operator v0.8.1 security update
    • Red Hat OpenShift Workload Availability 0.8 registry.redhat.io/workload-availability/fence-agents-remediation-rhel9-operator
  • RHSA-2026:51112 Released 2026-08-06 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) grafana-10.2.6-22.el9_6, grafana-selinux-10.2.6-22.el9_6
  • RHSA-2026:51033 Released 2026-08-06 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:50888 Released 2026-08-05 · Red Hat rating Important
    RHTAS 1.4.3 - CLI Stack Release
    • Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
  • RHSA-2026:50843 Released 2026-08-05 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.16
    • Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:50336 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.7-1.el10ap, receptorctl-1.6.7-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.15-2.el9ap, automation-controller-cli-4.7.15-2.el9ap, automation-controller-server-4.7.15-2.el9ap +15
  • RHSA-2026:50319 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.31-1.el8ap, automation-eda-controller-1.1.21-1.el8ap, automation-eda-controller-base-1.1.21-1.el8ap +11
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.31-1.el9ap, automation-eda-controller-1.1.21-1.el9ap, automation-eda-controller-base-1.1.21-1.el9ap +11
  • RHSA-2026:50300 Released 2026-08-04 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.1 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-ui-rhel9
  • RHSA-2026:49767 Released 2026-08-03 · Red Hat rating Important
    RHTAS 1.4.3 - CLI Stack Release
    • Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
  • RHSA-2026:49712 Released 2026-08-03 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) go-toolset-1.26.5-1.el9_6, golang-1.26.5-1.el9_6, golang-bin-1.26.5-1.el9_6 +5
  • RHSA-2026:49702 Released 2026-08-03 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) go-toolset-1.26.5-1.el10_0, golang-1.26.5-1.el10_0, golang-bin-1.26.5-1.el10_0 +5
  • RHSA-2026:48771 Released 2026-07-30 · Red Hat rating Important
    RHTAS 1.4.3 - CLI Stack Release
    • Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.3@amd64, conforma-cli-stack-v1-4-1.4.3@amd64_darwin, conforma-cli-stack-v1-4-1.4.3@amd64_windows +4
  • RHSA-2026:47952 Released 2026-07-29 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.2.12
    • Logging Subsystem for Red Hat OpenShift 6.2 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:43692 Released 2026-07-22 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.6 registry.redhat.io/oadp/oadp-velero-rhel9
  • RHSA-2026:43052 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.12.20
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:43038 Released 2026-07-21 · Red Hat rating Critical
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-solution-server-rhel9
  • RHSA-2026:42796 Released 2026-07-21 · Red Hat rating Important
    Red Hat Quay 3.15.6
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:42644 Released 2026-07-21 · Red Hat rating Important
    RHOAI 2.25.9 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-feature-server-rhel9, registry.redhat.io/rhoai/odh-kserve-storage-initializer-rhel9 +36
  • RHSA-2026:42146 Released 2026-07-20 · Red Hat rating Important
    Red Hat Quay 3.12.20
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:41066 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.16.5
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:41031 Released 2026-07-16 · Red Hat rating Important
    Red Hat Quay 3.10.24
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:40262 Released 2026-07-15 · Red Hat rating Important
    Red Hat Quay 3.9.24
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:37276 Released 2026-07-09 · Red Hat rating Important
    RHTAS 1.4.2 - CLI Stack Release
    • Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
  • RHSA-2026:36797 Released 2026-07-08 · Red Hat rating Important
    RHTAS 1.4.2 - CLI Stack Release
    • Red Hat Trusted Artifact Signer 1.4 conforma-cli-stack-v1-4-1.4.2@amd64, conforma-cli-stack-v1-4-1.4.2@amd64_darwin, conforma-cli-stack-v1-4-1.4.2@amd64_windows +4
  • RHSA-2026:36754 Released 2026-07-08 · Red Hat rating Important
    Red Hat Developer Hub 1.10.2 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:36625 Released 2026-07-08 · Red Hat rating Important
    RHACS 4.10.5 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2026:36319 Released 2026-07-07 · Red Hat rating Important
    RHACS 4.9.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2026:34364 Released 2026-07-01 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.4.6
    • Logging Subsystem for Red Hat OpenShift 6.4 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +2
  • RHSA-2026:33574 Released 2026-06-30 · Red Hat rating Important
    Red Hat Developer Hub 1.9.6 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:33150 Released 2026-06-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.3.5
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:33142 Released 2026-06-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.2.7
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:33123 Released 2026-06-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.1.10
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:33120 Released 2026-06-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.0.13
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:22112 Released 2026-06-01 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8, delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8, delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8 +22
  • RHSA-2026:22121 Released 2026-06-01 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.26.3-1.el9_8, golang-1.26.3-1.el9_8, golang-bin-1.26.3-1.el9_8 +5
  • RHSA-2026:22120 Released 2026-06-01 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.26.3-4.el10_2, golang-1.26.3-4.el10_2, golang-bin-1.26.3-4.el10_2 +5
  • RHSA-2026:17714 Released 2026-05-14 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images golang1.26-1.26.3-2.2.hum1@aarch64, golang1.26-1.26.3-2.2.hum1@src, golang1.26-1.26.3-2.2.hum1@x86_64 +10
  • RHSA-2026:17713 Released 2026-05-14 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images golang1.25-1.25.10-2.2.hum1@aarch64, golang1.25-1.25.10-2.2.hum1@src, golang1.25-1.25.10-2.2.hum1@x86_64 +10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Go standard library net/mail 1.25.10, 1.26.3

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-28702 Quadratic string concatentation in consumeComment in net/mailPriority MEDIUM 40
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Confidential Compute AttestationAffectedNo fix planned: Will not fix
External Secrets Operator for Red Hat OpenShiftAffectedNo fix planned: Will not fix
ExternalDNS OperatorAffectedNo fix yet
Fence Agents Remediation OperatorAffectedNo fix yet
File Integrity OperatorAffectedNo fix yet
Logical Volume Manager StorageAffectedNo fix yet
Machine Deletion Remediation OperatorAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
Multicluster Global HubAffectedNo fix planned: Out of support scope
Node HealthCheck OperatorAffectedNo fix yet
Node Maintenance OperatorAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix yet
OpenShift Service Mesh 3AffectedNo fix yet
Power monitoring for Red Hat OpenShiftAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ceph Storage 5AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 6AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 9AffectedNo fix planned: Out of support scope
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Cluster Manager CLIAffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Dev Workspaces OperatorAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Service Interconnect 2AffectedNo fix planned: Will not fix
Red Hat Trusted Artifact SignerAffectedNo fix yet
Self Node Remediation OperatorAffectedNo fix yet
Storage-Based RemediationAffectedNo fix yet
Zero Trust Workload Identity ManagerAffectedNo fix yet
Zero Trust Workload Identity Manager - Tech PreviewAffectedNo fix planned: Will not fix
Cert Manager support for Red Hat OpenShift release 1.18Fixed RHSA-2026:82347, RHSA-2026:82354, RHSA-2026:82372
Cert Manager support for Red Hat OpenShift release 1.19Fixed RHSA-2026:54531
Logging Subsystem for Red Hat OpenShift 6.0Fixed RHSA-2026:50843, RHSA-2026:83013
Logging Subsystem for Red Hat OpenShift 6.2Fixed RHSA-2026:47952
Logging Subsystem for Red Hat OpenShift 6.4Fixed RHSA-2026:34364
Logging Subsystem for Red Hat OpenShift 6.5Fixed RHSA-2026:56340
Logging Subsystem for Red Hat OpenShift 6.6Fixed RHSA-2026:92515
OpenShift API for Data Protection 1.3Fixed RHSA-2026:51033
OpenShift API for Data Protection 1.4Fixed RHSA-2026:59467
OpenShift API for Data Protection 1.5Fixed RHSA-2026:66022
OpenShift API for Data Protection 1.6Fixed RHSA-2026:43692
OpenShift Compliance Operator 1Fixed RHSA-2026:95612
OpenShift Security Profiles Operator 1Fixed RHSA-2026:76752
RHEM 1.1 for RHEL 10Fixed RHSA-2026:68334
RHEM 1.1 for RHEL 9Fixed RHSA-2026:68334
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:36319
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:36625
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:50319
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:50319
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:50336
Red Hat Developer Hub 1.10Fixed RHSA-2026:36754
Red Hat Developer Hub 1.9Fixed RHSA-2026:33574
Red Hat Edge Manager 1.1Fixed RHSA-2026:68044, RHSA-2026:68253
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:22120, RHSA-2026:63022, RHSA-2026:63332, RHSA-2026:64818, RHSA-2026:65116, RHSA-2026:65534, RHSA-2026:65895, RHSA-2026:70201
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:22112, RHSA-2026:62407, RHSA-2026:63163, RHSA-2026:67148
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:22121, RHSA-2026:62406, RHSA-2026:65117, RHSA-2026:65153, RHSA-2026:65886
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:90994
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:87246, RHSA-2026:88339
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:68504, RHSA-2026:87245, RHSA-2026:88340
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:61253, RHSA-2026:62754, RHSA-2026:76809
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:57649, RHSA-2026:62753, RHSA-2026:68527, RHSA-2026:76795
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:49702, RHSA-2026:65335, RHSA-2026:66327, RHSA-2026:67517, RHSA-2026:67974
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:49712, RHSA-2026:51112, RHSA-2026:62803, RHSA-2026:65336, RHSA-2026:67975
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:90994
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:87246, RHSA-2026:88339
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:68504, RHSA-2026:87245, RHSA-2026:88340
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:70201
Red Hat Hardened ImagesFixed RHSA-2026:17713, RHSA-2026:17714
Red Hat Lightspeed (formerly Insights) for Runtimes 1.0Fixed RHSA-2026:73538
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat Migration Toolkit for Applications 8.1Fixed RHSA-2026:50300
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:43038
Red Hat OpenShift AI 2.25Fixed RHSA-2026:42644
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734, RHSA-2026:91248
Red Hat OpenShift AI 3.5Fixed RHSA-2026:91249
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:59830, RHSA-2026:59833
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:65838, RHSA-2026:65840
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:56785, RHSA-2026:56789
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:56910, RHSA-2026:56912
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:56852, RHSA-2026:56854, RHSA-2026:57845
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:60018, RHSA-2026:60023
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:57482, RHSA-2026:57487, RHSA-2026:57914
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:54552, RHSA-2026:54555, RHSA-2026:63636, RHSA-2026:68534
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:54583
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:54602
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat OpenShift Dev Spaces 3.31Fixed RHSA-2026:90321
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:33120
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:33123
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:33142
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:33150
Red Hat OpenShift Workload Availability 0.12Fixed RHSA-2026:54287
Red Hat OpenShift Workload Availability 0.13Fixed RHSA-2026:54284
Red Hat OpenShift Workload Availability 0.3Fixed RHSA-2026:54286
Red Hat OpenShift Workload Availability 0.7Fixed RHSA-2026:54285
Red Hat OpenShift Workload Availability 0.8Fixed RHSA-2026:54274
Red Hat OpenShift Workload Availability 5.7Fixed RHSA-2026:54283
Red Hat Quay 3.10Fixed RHSA-2026:41031
Red Hat Quay 3.12Fixed RHSA-2026:42146, RHSA-2026:43052
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:42796
Red Hat Quay 3.16Fixed RHSA-2026:41066
Red Hat Quay 3.17Fixed RHSA-2026:74511
Red Hat Quay 3.9Fixed RHSA-2026:40262
Red Hat Satellite 6.18Fixed RHSA-2026:68764
Red Hat Satellite 6.19Fixed RHSA-2026:68780
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:36797, RHSA-2026:48771
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:57194
Not affected: 83 products
  • Cert Manager support for Red Hat OpenShift release 1.19
  • Cryostat 4
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • File Integrity Operator
  • Gatekeeper 3
  • Logging Subsystem for Red Hat OpenShift 6.0
  • Logging Subsystem for Red Hat OpenShift 6.2
  • Logging Subsystem for Red Hat OpenShift 6.4
  • Logging Subsystem for Red Hat OpenShift 6.5
  • Logging Subsystem for Red Hat OpenShift 6.6
  • Logical Volume Manager Storage
  • Multiarch Tuning Operator
  • Multicluster Engine for Kubernetes
  • Multicluster Global Hub
  • Network Observability Operator
  • OpenShift API for Data Protection 1.3
  • OpenShift API for Data Protection 1.4
  • OpenShift API for Data Protection 1.5
  • OpenShift API for Data Protection 1.6
  • OpenShift Compliance Operator 1
  • OpenShift Security Profiles Operator 1
  • OpenShift Service Mesh 2
  • RHEM 1.1 for RHEL 10
  • RHEM 1.1 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Developer Hub 1.10
  • Red Hat Developer Hub 1.9
  • Red Hat Edge Manager 1.1
  • Red Hat Enterprise Linux 9
  • Red Hat Lightspeed (formerly Insights) for Runtimes 1.0
  • Red Hat Migration Toolkit 1.8
  • Red Hat Migration Toolkit for Applications 8.1
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Dev Spaces 3.31
  • Red Hat OpenShift Service Mesh 3.0
  • Red Hat OpenShift Service Mesh 3.1
  • Red Hat OpenShift Service Mesh 3.2
  • Red Hat OpenShift Service Mesh 3.3
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift Workload Availability 0.12
  • Red Hat OpenShift Workload Availability 0.13
  • Red Hat OpenShift Workload Availability 0.3
  • Red Hat OpenShift Workload Availability 0.7
  • Red Hat OpenShift Workload Availability 0.8
  • Red Hat OpenShift Workload Availability 5.7
  • Red Hat OpenShift for Windows Containers
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.9
  • Red Hat Service Interconnect 1
  • Red Hat Trusted Artifact Signer 1.4
  • multicluster engine for Kubernetes 2.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42499
  2. 2026-10-03 Alias added: GHSA-xq5j-9r39-c3vf
  3. 2026-10-07 Fix available: RHSA-2026:76795 · Red Hat
  4. 2026-10-07 Fix available: RHSA-2026:76809 · Red Hat
  5. 2026-10-07 Affected versions changed · Red Hat
  6. 2026-10-07 Fix available: RHSA-2026:76752 · Red Hat
  7. 2026-10-07 Fix available: OpenShift Security Profiles Operator 1 · Red Hat
  8. 2026-10-09 Affected versions changed · Red Hat
  9. 2026-10-10 Affected versions changed · Red Hat
  10. 2026-10-14 Fix available: RHSA-2026:82372 · Red Hat
  11. 2026-10-14 Fix available: RHSA-2026:82354 · Red Hat
  12. 2026-10-14 Fix available: RHSA-2026:82347 · Red Hat
  13. 2026-10-15 Fix available: RHSA-2026:83013 · Red Hat
  14. 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.18, Logging Subsystem for Red Hat OpenShift 6.0 · Red Hat
  15. 2026-10-18 Affected versions changed · Red Hat
  16. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  17. 2026-10-20 Affected versions changed · Red Hat
  18. 2026-10-22 Fix available: RHSA-2026:87245 · Red Hat
  19. 2026-10-22 Fix available: RHSA-2026:87246 · Red Hat
  20. 2026-10-23 Fix available: RHSA-2026:88340 · Red Hat
  21. 2026-10-23 Fix available: RHSA-2026:88339 · Red Hat
  22. 2026-10-23 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · Red Hat
  23. 2026-10-29 Fix available: RHSA-2026:90994 · Red Hat
  24. 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · Red Hat
  25. 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
  26. 2026-10-30 Fix available: RHSA-2026:91248 · Red Hat
  27. 2026-10-30 Fix available: RHSA-2026:91249 · Red Hat
  28. 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
  29. 2026-10-30 Fix available: Red Hat OpenShift AI 3.5 · Red Hat
  30. 2026-10-30 Affected versions changed · Red Hat
  31. 2026-10-30 Fix available: Logging Subsystem for Red Hat OpenShift 6.6 · Red Hat
  32. 2026-10-31 Fix available: RHSA-2026:92593 · Red Hat
  33. 2026-10-31 Fix available: RHSA-2026:92515 · Red Hat
  34. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat
  35. 2026-11-06 Fix available: OpenShift Compliance Operator 1 · Red Hat
  36. 2026-11-06 Fix available: RHSA-2026:95612 · Red Hat
  37. 2026-11-06 Fix available: RHSA-2026:42644 · Red Hat

References

Patch 1

Advisory 1

Other 2

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences