Read the docs
TI-2026-34259 Aliases CVE-2026-46600GHSA-gg3m-vvp2-p2c5

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Priority MEDIUM 40CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 19 fixed, 9 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Fix Partial net (Go standard library): 1.26.6, 1.27.0-rc.3golang.org/x/net/dns/dnsmessage (golang.org/x/net): 0.56.0Red Hat: 31 advisoriesRed Hat: 19 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarynet1.26.0-0 to before 1.26.6; 1.27.0-0 to before 1.27.0-rc.31.26.6, 1.27.0-rc.3Patch availableCNA
Go standard librarygolang.org/x/net/dns/dnsmessagebefore 0.56.00.56.0Patch availableCNA
  • net VendorGo standard library Affected 1.26.0-0 to before 1.26.6; 1.27.0-0 to before 1.27.0-rc.3 Fixed in 1.26.6, 1.27.0-rc.3 Patch available CNA
  • golang.org/x/net/dns/dnsmessage VendorGo standard library Affected before 0.56.0 Fixed in 0.56.0 Patch available CNA

Remediation

  • Fix · CNA net (Go standard library) Fixed in 1.26.6, 1.27.0-rc.3
  • Fix · CNA golang.org/x/net/dns/dnsmessage (golang.org/x/net) Fixed in 0.56.0

Red Hat 31 advisories

  • RHSA-2026:89131 Released 2026-10-24 · Red Hat rating Critical
    Red Hat OpenShift Builds 1.9.2
    • Red Hat OpenShift Builds 1.9.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10 +6
  • RHSA-2026:89081 Released 2026-10-24 · Red Hat rating Critical
    Red Hat OpenShift Builds 1.8.3
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +6
  • RHSA-2026:89041 Released 2026-10-24 · Red Hat rating Important
    Red Hat OpenShift Builds 1.9.2
    • Red Hat OpenShift Builds 1.9.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10 +7
Show 28 more Red Hat advisories
  • RHSA-2026:89031 Released 2026-10-24 · Red Hat rating Important
    Red Hat OpenShift Builds 1.8.3
    • Red Hat OpenShift Builds 1.8.3 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +7
  • RHSA-2026:83013 Released 2026-10-14 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.17
    • Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:72892 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +10
  • RHSA-2026:72884 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.8 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +17
  • RHSA-2026:72879 Released 2026-09-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +7
  • RHSA-2026:72853 Released 2026-09-28 · Red Hat rating Important
    multicluster engine for Kubernetes v2.10.7 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/discovery-rhel9 +7
  • RHSA-2026:72476 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72470 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:72399 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72394 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:70870 Released 2026-09-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.5.3
    • Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:69268 Released 2026-09-21 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.11.1 release
    • Red Hat OpenShift distributed tracing 3.11 registry.redhat.io/rhosdt/opentelemetry-collector-rhel9, registry.redhat.io/rhosdt/opentelemetry-rhel9-operator
  • RHSA-2026:67714 Released 2026-09-15 · Red Hat rating Important
    RHACS 4.11.4 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9 +1
  • RHSA-2026:67707 Released 2026-09-15 · Red Hat rating Important
    OpenShift Compliance Operator bug fix and enhancement update
    • OpenShift Compliance Operator 1 registry.redhat.io/compliance/openshift-compliance-operator-bundle, registry.redhat.io/compliance/openshift-compliance-rhel8-operator
  • RHSA-2026:63138 Released 2026-09-03 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.19.2
    • Cert Manager support for Red Hat OpenShift release 1.19 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:63135 Released 2026-09-03 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.19.2
    • Cert Manager support for Red Hat OpenShift release 1.19 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:61314 Released 2026-08-31 · Red Hat rating Important
    Cluster Observability Operator 1.5.2
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
  • RHSA-2026:60391 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +19
  • RHSA-2026:60390 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +23
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
  • RHSA-2026:60389 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.6 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9 +19
  • RHSA-2026:60387 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:54773 Released 2026-08-13 · Red Hat rating Important
    Red Hat build of OpenTelemetry 3.10.2 release
    • Red Hat OpenShift distributed tracing 3.10.1 registry.redhat.io/rhosdt/opentelemetry-collector-rhel9, registry.redhat.io/rhosdt/opentelemetry-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
ExternalDNS OperatorAffectedNo fix yet
File Integrity OperatorAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82304, RHSA-2026:82322
Cert Manager support for Red Hat OpenShift release 1.19Fixed RHSA-2026:63135, RHSA-2026:63138
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72394, RHSA-2026:72395, RHSA-2026:72399, RHSA-2026:72470, RHSA-2026:72475, RHSA-2026:72476
Cluster Observability Operator 1.5Fixed RHSA-2026:61314
Logging Subsystem for Red Hat OpenShift 6.0Fixed RHSA-2026:83013
Logging Subsystem for Red Hat OpenShift 6.5Fixed RHSA-2026:70870
OpenShift Compliance Operator 1Fixed RHSA-2026:67707
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:60387
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:60390
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:60389, RHSA-2026:72884
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:60391, RHSA-2026:72892
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386, RHSA-2026:72879
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:67714
Red Hat OpenShift Builds 1.8.3Fixed RHSA-2026:89031, RHSA-2026:89081
Red Hat OpenShift Builds 1.9.2Fixed RHSA-2026:89041, RHSA-2026:89131
Red Hat OpenShift distributed tracing 3.10.1Fixed RHSA-2026:54773
Red Hat OpenShift distributed tracing 3.11Fixed RHSA-2026:69268
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:72853
Not affected: 24 products
  • Cert Manager support for Red Hat OpenShift release 1.20
  • Cluster Observability Operator 1.5
  • File Integrity Operator
  • Logging Subsystem for Red Hat OpenShift 6.0
  • Logging Subsystem for Red Hat OpenShift 6.5
  • Multicluster Engine for Kubernetes
  • OpenShift Compliance Operator 1
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Advanced Cluster Security 4
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Builds 1.8.3
  • Red Hat OpenShift Builds 1.9.2
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift distributed tracing 3.10.1
  • Red Hat OpenShift distributed tracing 3.11
  • multicluster engine for Kubernetes 2.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-46600
  2. 2026-10-03 Alias added: GHSA-gg3m-vvp2-p2c5
  3. 2026-10-09 Fix available: Red Hat OpenShift distributed tracing 3.11.2 · Red Hat
  4. 2026-10-10 Fix available: Compliance Operator 1 · Red Hat
  5. 2026-10-13 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat
  6. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
  7. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  8. 2026-10-15 Fix available: RHSA-2026:83013 · Red Hat
  9. 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.17, Logging Subsystem for Red Hat OpenShift 6.0 · Red Hat
  10. 2026-10-22 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
  11. 2026-10-25 Fix available: RHSA-2026:89081 · Red Hat
  12. 2026-10-25 Fix available: RHSA-2026:89031 · Red Hat
  13. 2026-10-25 Fix available: RHSA-2026:89131 · Red Hat
  14. 2026-10-25 Fix available: RHSA-2026:89041 · Red Hat
  15. 2026-10-25 Fix available: Red Hat OpenShift Builds 1.8.3, Red Hat OpenShift Builds 1.9.2, Red Hat OpenShift distributed tracing 3.11.3 · Red Hat
  16. 2026-10-26 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat
  17. 2026-10-30 Affected versions changed · Red Hat
  18. 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11, Red Hat OpenShift distributed tracing 3.10.1 · Red Hat
  19. 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat
  20. 2026-11-06 Fix available: OpenShift Compliance Operator 1 · Red Hat

References

Other 4

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences