The Container Network Interface (CNI) project provides specifications and libraries for configuring network interfaces in Linux containers. Red Hat's advisory RHSA-2026:3341 addresses three security issues in containernetworking-plugins related to Golang components: CVE-2025-61729 (Denial of Service via excessive resource consumption from crafted certificates in crypto/x509), CVE-2025-61726 (Memory exhaustion during query parameter parsing in net/url), and CVE-2025-68121 (Unexpected session resumption in crypto/tls). These vulnerabilities could lead to denial of service or unexpected TLS session behavior affecting container networking. The advisory covers Red Hat Enterprise Linux 9 versions from 9.0 up to but not including 9.8. Updated packages contain fixes for these issues.

The vulnerabilities can cause denial of service conditions due to excessive resource consumption or memory exhaustion, potentially disrupting container network connectivity. The unexpected TLS session resumption could lead to unexpected session behavior, which may affect security assumptions in TLS communications within container networking. No known exploits in the wild have been reported. The impact is rated as Important by Red Hat, indicating significant but not critical risk.

Red Hat has released updated containernetworking-plugins packages that address these vulnerabilities. Users should apply the security update for Red Hat Enterprise Linux 9 as detailed in advisory RHSA-2026:3341. The vendor provides official fixes; applying these updates is the recommended remediation. Refer to https://access.redhat.com/articles/11258 for update instructions. No additional mitigations are specified or required beyond applying the official patch.