Read the docs
TI-2026-69833 Aliases CVE-2026-94440GHSA-874m-fcc5-9gqf

Memory limit bypass in Go net/textproto and mime/multipart parsing

Priority MEDIUM 40CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 28 fixed, 27 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

The Go standard library packages net/textproto and mime/multipart are affected from 0 before 1.26.9 and from 1.27.0-0 before 1.27.2. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when fewer than 400 bytes remain in the limit at the start of a part (CWE-770). A remote attacker without privileges or user interaction can exhaust memory, affecting availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00706 53rd percentileScored 2026-11-07
Fix Partial net/textproto (Go standard library): 1.26.9, 1.27.2mime/multipart (Go standard library): 1.26.9, 1.27.2Red Hat: 49 advisoriesRed Hat: 28 fixed, 27 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarynet/textprotobefore 1.26.9; 1.27.0-0 to before 1.27.21.26.9, 1.27.2Patch availableCNA
Go standard librarymime/multipartbefore 1.26.9; 1.27.0-0 to before 1.27.21.26.9, 1.27.2Patch availableCNA
  • net/textproto VendorGo standard library Affected before 1.26.9; 1.27.0-0 to before 1.27.2 Fixed in 1.26.9, 1.27.2 Patch available CNA
  • mime/multipart VendorGo standard library Affected before 1.26.9; 1.27.0-0 to before 1.27.2 Fixed in 1.26.9, 1.27.2 Patch available CNA

Remediation

The fixed versions are Go 1.26.9 and 1.27.2. Red Hat advisories include RHSA-2026:95519, RHSA-2026:93617 and RHSA-2026:92516. Red Hat lists OpenShift Developer Tools and Services and OpenShift Pipelines with no fix planned, and OpenShift Serverless, OpenShift Service Mesh 3, Red Hat Enterprise Linux 7, 8, 9 and 10, and other products with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA net/textproto (Go standard library) Fixed in 1.26.9, 1.27.2
  • Fix · CNA mime/multipart (Go standard library) Fixed in 1.26.9, 1.27.2

Red Hat 49 advisories

  • RHSA-2026:95519 Released 2026-11-05 · Red Hat rating Important
    delve security update
    • Red Hat Enterprise Linux AppStream (v. 10) delve-1.26.1-3.el10_2
  • RHSA-2026:95014 Released 2026-11-04 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) opentelemetry-collector-0.158.0-2.el9_6
  • RHSA-2026:95015 Released 2026-11-04 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) opentelemetry-collector-0.158.0-2.el9_4
Show 46 more Red Hat advisories
  • RHSA-2026:95016 Released 2026-11-04 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) opentelemetry-collector-0.158.0-2.el10_0
  • RHSA-2026:93617 Released 2026-11-02 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 9) opentelemetry-collector-0.158.0-2.el9_8
  • RHSA-2026:93596 Released 2026-11-02 · Red Hat rating Important
    opentelemetry-collector security update
    • Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector-0.158.0-2.el10_2
  • RHSA-2026:92859 Released 2026-10-29 · Red Hat rating Important
    Satellite 6.17 security update
    • Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
  • RHSA-2026:92861 Released 2026-10-29 · Red Hat rating Critical
    Satellite 6.19 security update
    • Red Hat Satellite 6.19 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, python3.12-brotli-1.2.1-1.el9pc +6
  • RHSA-2026:92858 Released 2026-10-29 · Red Hat rating Important
    Satellite 6.16 EUS security update
    • Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.31.1-1.el8sat, openvox-server-8.17.0-1.el8sat, yggdrasil-worker-forwarder-0.1.1-1.el8sat
    • Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
  • RHSA-2026:92860 Released 2026-10-29 · Red Hat rating Important
    Satellite 6.18 security update
    • Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
  • RHSA-2026:92516 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.4.4
    • Red Hat OpenShift Service Mesh 3.4 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:92509 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.3.9
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:92497 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.2.11
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:92480 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.1.14
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:92451 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 3.0.17
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/istio-cni-rhel9, registry.redhat.io/openshift-service-mesh/istio-pilot-rhel9, registry.redhat.io/openshift-service-mesh/istio-proxyv2-rhel9 +1
  • RHSA-2026:92372 Released 2026-10-29 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) osbuild-composer-76.1-10.el9_2, osbuild-composer-core-76.1-10.el9_2, osbuild-composer-dnf-json-76.1-10.el9_2 +1
  • RHSA-2026:91958 Released 2026-10-28 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) osbuild-composer-101.3-4.el9_4.7, osbuild-composer-core-101.3-4.el9_4.7, osbuild-composer-worker-101.3-4.el9_4.7
  • RHSA-2026:91646 Released 2026-10-28 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) osbuild-composer-134.1-13.el10_0, osbuild-composer-core-134.1-13.el10_0, osbuild-composer-worker-134.1-13.el10_0
  • RHSA-2026:91587 Released 2026-10-28 · Red Hat rating Important
    osbuild-composer security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) osbuild-composer-132.2-13.el9_6, osbuild-composer-core-132.2-13.el9_6, osbuild-composer-worker-132.2-13.el9_6
  • RHSA-2026:91572 Released 2026-10-28 · Red Hat rating Important
    yggdrasil security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) yggdrasil-0.4.7-6.el10_0.1
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) yggdrasil-devel-0.4.7-6.el10_0.1
  • RHSA-2026:91138 Released 2026-10-27 · Red Hat rating Important
    yggdrasil security update
    • Red Hat Enterprise Linux AppStream (v. 10) yggdrasil-0.4.9.2-1.el10_2.4
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) yggdrasil-devel-0.4.9.2-1.el10_2.4
  • RHSA-2026:90994 Released 2026-10-27 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.4.0+25181+7ce5b91c.x86_64::go-toolset:rhel8, go-toolset-1.26.10-2.module+el8.4.0+25201+9a419e96.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:89933 Released 2026-10-26 · Red Hat rating Important
    delve security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) delve-1.26.1-1.el9_6.2
  • RHSA-2026:90332 Released 2026-10-26 · Red Hat rating Important
    RHOSO 18.0 os-diff security update
    • 9Base-RHOSO-TOOLS-18 golang-github-openstack-k8s-operators-os-diff-0.1.1-18.0.20261021172337.a95ae05.el9ost
    • Red Hat OpenStack Services on OpenShift 18.0 golang-github-openstack-k8s-operators-os-diff-0.1.1-18.0.20261021172337.a95ae05.el9ost
  • RHSA-2026:89888 Released 2026-10-26 · Red Hat rating Important
    delve security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) delve-1.26.1-1.el9_2.2
  • RHSA-2026:89885 Released 2026-10-26 · Red Hat rating Important
    delve security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) delve-1.26.1-1.el9_4.2
  • RHSA-2026:89884 Released 2026-10-26 · Red Hat rating Important
    delve security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) delve-1.26.1-3.el10_0
  • RHSA-2026:89732 Released 2026-10-26 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 10) grafana-10.2.6-28.el10_2.9, grafana-selinux-10.2.6-28.el10_2.9
  • RHSA-2026:88395 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) grafana-pcp-3.2.0-6.el8_8.2
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) grafana-pcp-3.2.0-6.el8_8.2
  • RHSA-2026:88394 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) grafana-pcp-3.2.0-4.el8_6.2
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) grafana-pcp-3.2.0-4.el8_6.2
  • RHSA-2026:88340 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) grafana-7.5.15-12.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) grafana-7.5.15-12.el8_8
  • RHSA-2026:88339 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) grafana-7.5.11-12.el8_6
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) grafana-7.5.11-12.el8_6
  • RHSA-2026:88317 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) grafana-pcp-5.3.0-1.el10_0.2
  • RHSA-2026:88189 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-pcp-5.1.1-19.el8_10
  • RHSA-2026:88188 Released 2026-10-22 · Red Hat rating Important
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-36.el8_10, grafana-selinux-9.2.10-36.el8_10
  • RHSA-2026:87911 Released 2026-10-22 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) grafana-pcp-5.1.1-15.el9_6.2
  • RHSA-2026:87245 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8 +13
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.26.1-1.module+el8.8.0+24781+86ad105d.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.8.0+24781+86ad105d.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.8.0+25113+a148ecc0.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:87246 Released 2026-10-21 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) delve-1.26.1-1.module+el8.6.0+24782+a062e766.src::go-toolset:rhel8, delve-1.26.1-1.module+el8.6.0+24782+a062e766.x86_64::go-toolset:rhel8, go-toolset-1.26.10-4.module+el8.6.0+25114+90ecdb41.x86_64::go-toolset:rhel8 +8
  • RHSA-2026:87043 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) go-toolset-1.26.10-1.el9_6, golang-1.26.10-1.el9_6, golang-bin-1.26.10-1.el9_6 +5
  • RHSA-2026:87042 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) go-toolset-1.26.10-1.el9_4, golang-1.26.10-1.el9_4, golang-bin-1.26.10-1.el9_4 +5
  • RHSA-2026:87041 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) go-toolset-1.26.10-1.el9_2, golang-1.26.10-1.el9_2, golang-bin-1.26.10-1.el9_2 +5
  • RHSA-2026:87040 Released 2026-10-21 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) go-toolset-1.26.10-1.el10_0, golang-1.26.10-1.el10_0, golang-bin-1.26.10-1.el10_0 +5
  • RHSA-2026:86972 Released 2026-10-21 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) grafana-pcp-5.1.1-10.el9_4
  • RHSA-2026:86973 Released 2026-10-21 · Red Hat rating Important
    grafana-pcp security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) grafana-pcp-5.1.1-5.el9_2.3
  • RHSA-2026:86196 Released 2026-10-20 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.26.10-1.el9_8, golang-1.26.10-1.el9_8, golang-bin-1.26.10-1.el9_8 +5
  • RHSA-2026:86203 Released 2026-10-20 · Red Hat rating Important
    go-toolset:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.26.1-1.module+el8.10.0+24516+40554724.aarch64::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.ppc64le::go-toolset:rhel8, delve-1.26.1-1.module+el8.10.0+24516+40554724.src::go-toolset:rhel8 +22
  • RHSA-2026:86093 Released 2026-10-20 · Red Hat rating Important
    golang security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.26.10-1.el10_2, golang-1.26.10-1.el10_2, golang-bin-1.26.10-1.el10_2 +5
  • RHSA-2026:86029 Released 2026-10-20 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images golang1.27-1.27.3-1.hum1@aarch64, golang1.27-1.27.3-1.hum1@s390x, golang1.27-1.27.3-1.hum1@src +16
  • RHSA-2026:85899 Released 2026-10-20 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images golang1.26-1.26.10-0.1.hum1@aarch64, golang1.26-1.26.10-0.1.hum1@s390x, golang1.26-1.26.10-0.1.hum1@src +16

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix planned: Out of support scope
OpenShift PipelinesAffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 3AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Edge Manager 1AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)Affected—
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 17.1AffectedNo fix planned: Out of support scope
Red Hat Service Interconnect 1AffectedNo fix planned: Out of support scope
Red Hat Service Interconnect 2AffectedNo fix yet
streams for Apache Kafka 2AffectedNo fix planned: Out of support scope
streams for Apache Kafka 3AffectedNo fix yet
9Base-RHOSO-TOOLS-18Fixed RHSA-2026:90332
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:86093, RHSA-2026:89732, RHSA-2026:91138, RHSA-2026:93596, RHSA-2026:95519
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:86203, RHSA-2026:88188, RHSA-2026:88189
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:86196, RHSA-2026:93617
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:90994
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:87246, RHSA-2026:88339, RHSA-2026:88394
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:87245, RHSA-2026:88340, RHSA-2026:88395
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:86973, RHSA-2026:87041, RHSA-2026:89888, RHSA-2026:92372
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:86972, RHSA-2026:87042, RHSA-2026:89885, RHSA-2026:91958, RHSA-2026:95015
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:87040, RHSA-2026:88317, RHSA-2026:89884, RHSA-2026:91572, RHSA-2026:91646, RHSA-2026:95016
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:87043, RHSA-2026:87911, RHSA-2026:89933, RHSA-2026:91587, RHSA-2026:95014
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:90994
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:87246, RHSA-2026:88339, RHSA-2026:88394
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:87245, RHSA-2026:88340, RHSA-2026:88395
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:91138
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:91572
Red Hat Hardened ImagesFixed RHSA-2026:85899, RHSA-2026:86029
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:92451
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:92480
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:92497
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:92509
Red Hat OpenShift Service Mesh 3.4Fixed RHSA-2026:92516
Red Hat OpenStack Services on OpenShift 18.0Fixed RHSA-2026:90332
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:92858
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:92858
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:92859
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:92860
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:92861
Not affected: 17 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Service Mesh 3.0
  • Red Hat OpenShift Service Mesh 3.1
  • Red Hat OpenShift Service Mesh 3.2
  • Red Hat OpenShift Service Mesh 3.3
  • Red Hat OpenShift Service Mesh 3.4
  • Red Hat OpenStack Platform 18.0
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-94440
  2. 2026-10-09 Alias added: GHSA-874m-fcc5-9gqf
  3. 2026-10-10 CVSS score added · CISA ADP
  4. 2026-10-10 Weakness changed · CISA ADP
  5. 2026-10-10 CISA SSVC decision points changed
  6. 2026-10-23 Fix available: RHSA-2026:87246 · Red Hat
  7. 2026-10-23 Fix available: RHSA-2026:85899 · Red Hat
  8. 2026-10-23 Fix available: RHSA-2026:86029 · Red Hat
  9. 2026-10-23 Fix available: RHSA-2026:86093 · Red Hat
  10. 2026-10-23 Fix available: RHSA-2026:86196 · Red Hat
  11. 2026-10-23 Fix available: RHSA-2026:86203 · Red Hat
  12. 2026-10-23 Fix available: RHSA-2026:87042 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:87040 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:87041 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:87043 · Red Hat
  16. 2026-10-23 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +7 · Red Hat
  17. 2026-10-23 CVSS score added · Red Hat
  18. 2026-10-24 Fix available: RHSA-2026:87245 · Red Hat
  19. 2026-10-24 Fix available: RHSA-2026:88189 · Red Hat
  20. 2026-10-24 Fix available: RHSA-2026:88188 · Red Hat
  21. 2026-10-24 Fix available: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · Red Hat
  22. 2026-10-26 Fix available: RHSA-2026:89732 · Red Hat
  23. 2026-10-26 Fix available: RHSA-2026:89888 · Red Hat
  24. 2026-10-26 Fix available: RHSA-2026:89884 · Red Hat
  25. 2026-10-26 Affected versions changed · Red Hat
  26. 2026-10-26 Fix available: RHSA-2026:86972 · Red Hat
  27. 2026-10-26 Fix available: RHSA-2026:86973 · Red Hat
  28. 2026-10-26 Fix available: RHSA-2026:87911 · Red Hat
  29. 2026-10-26 Fix available: RHSA-2026:88317 · Red Hat
  30. 2026-10-26 Fix available: RHSA-2026:88340 · Red Hat
  31. 2026-10-26 Fix available: RHSA-2026:88339 · Red Hat
  32. 2026-10-26 Fix available: RHSA-2026:88394 · Red Hat
  33. 2026-10-26 Fix available: RHSA-2026:88395 · Red Hat
  34. 2026-10-26 Fix available: RHSA-2026:89885 · Red Hat
  35. 2026-10-26 Fix available: RHSA-2026:90332 · Red Hat
  36. 2026-10-26 Fix available: 9Base-RHOSO-TOOLS-18, Red Hat OpenStack Services on OpenShift 18.0 · Red Hat
  37. 2026-10-27 Affected versions changed · Red Hat
  38. 2026-10-29 Fix available: RHSA-2026:89933 · Red Hat
  39. 2026-10-29 Fix available: RHSA-2026:91138 · Red Hat
  40. 2026-10-29 Fix available: RHSA-2026:90994 · Red Hat
  41. 2026-10-29 Fix available: RHSA-2026:91646 · Red Hat
  42. 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · Red Hat
  43. 2026-10-29 Fix available: RHSA-2026:92372 · Red Hat
  44. 2026-10-29 Affected versions changed · Red Hat
  45. 2026-10-30 Fix available: RHSA-2026:91572 · Red Hat
  46. 2026-10-30 Fix available: RHSA-2026:91587 · Red Hat
  47. 2026-10-30 Fix available: RHSA-2026:91958 · Red Hat
  48. 2026-10-30 Fix available: RHSA-2026:92451 · Red Hat
  49. 2026-10-30 Fix available: RHSA-2026:92509 · Red Hat
  50. 2026-10-30 Fix available: RHSA-2026:92497 · Red Hat
  51. 2026-10-30 Fix available: RHSA-2026:92480 · Red Hat
  52. 2026-10-30 Fix available: RHSA-2026:92858 · Red Hat
  53. 2026-10-30 Fix available: RHSA-2026:92859 · Red Hat
  54. 2026-10-30 Fix available: Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat OpenShift Service Mesh 3.0, Red Hat OpenShift Service Mesh 3.1 +5 · Red Hat
  55. 2026-10-30 Fix available: RHSA-2026:92860 · Red Hat
  56. 2026-10-30 Fix available: Red Hat Satellite 6.18 for RHEL 9 · Red Hat
  57. 2026-10-30 Fix available: Red Hat OpenShift Service Mesh 3.4, Red Hat Satellite 6.19 for RHEL 9 · Red Hat
  58. 2026-10-31 Fix available: RHSA-2026:92516 · Red Hat
  59. 2026-10-31 Fix available: RHSA-2026:92861 · Red Hat
  60. 2026-11-02 Affected versions changed · Red Hat
  61. 2026-11-02 Fix available: RHSA-2026:93617 · Red Hat
  62. 2026-11-02 Affected versions changed · Red Hat
  63. 2026-11-03 Fix available: RHSA-2026:93596 · Red Hat
  64. 2026-11-03 Affected versions changed · Red Hat
  65. 2026-11-04 Fix available: RHSA-2026:95015 · Red Hat
  66. 2026-11-04 Fix available: RHSA-2026:95014 · Red Hat
  67. 2026-11-04 Fix available: RHSA-2026:95016 · Red Hat
  68. 2026-11-04 Affected versions changed · Red Hat
  69. 2026-11-06 Fix available: RHSA-2026:95519 · Red Hat
  70. 2026-11-06 Affected versions changed · Red Hat
  71. 2026-11-06 Affected versions changed · Red Hat
  72. 2026-11-07 EPSS moved to the 50th–90th percentile
  73. 2026-11-08 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-24278 HTTP/2 CONTINUATION flood in net/http CVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2024-16309 Panic when parsing invalid palette-color images in golang.org/x/image CVSS 3.1HIGH 7.5
  • TI-2022-20112 Request smuggling due to improper request handling in golang.org/x/net/http2/h2c CVSS 3.1HIGH 7.5
See all 297 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences