The Red Hat build of Cryostat 4 on RHEL 9 is affected by multiple vulnerabilities in Go language libraries. CVE-2026-32280 describes a denial of service vulnerability in certificate chain building within the crypto/x509 package. CVE-2026-32283 involves a denial of service via multiple TLS 1.3 key update messages in the crypto/tls package. CVE-2026-33810 details a certificate validation bypass caused by incorrect DNS constraint application in crypto/x509. CVE-2026-32282 concerns the internal syscall/unix package where Root.Chmod can follow symlinks outside the root directory. These vulnerabilities collectively impact the security of TLS communications and system file permissions in affected Cryostat builds. Red Hat has released security updates to address these issues.

The vulnerabilities can lead to denial of service conditions in TLS communications and certificate chain validation, potentially disrupting secure connections. The certificate validation bypass may allow improper acceptance of TLS certificates, weakening security guarantees. The Root.Chmod symlink issue could allow unauthorized modification of files outside the intended root directory, posing a risk to system integrity. These impacts affect the confidentiality, integrity, and availability of systems running the affected Cryostat versions.

Red Hat has released security updates for the Red Hat build of Cryostat 4 on RHEL 9 that address these vulnerabilities. Users should apply the available updates as per Red Hat's guidance to remediate these issues. Before applying this update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official advisory and update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps.