The Red Hat security advisory RHSA-2026:17084 addresses several vulnerabilities in gvisor-tap-vsock, a Go-based replacement for libslirp and VPNKit used in Red Hat Enterprise Linux 10.0 EUS. The fixed issues include: CVE-2025-61729 (DoS via crafted certificate in crypto/x509), CVE-2025-61726 (memory exhaustion in net/url query parsing), CVE-2025-68121 (unexpected TLS session resumption), CVE-2026-25679 (incorrect IPv6 host literal parsing in net/url), CVE-2026-32282 (Root.Chmod following symlinks out of root), CVE-2026-32283 (DoS via multiple TLS 1.3 key update messages), and CVE-2026-32280 (DoS in certificate chain building). These vulnerabilities could lead to denial of service or incorrect behavior in TLS and URL parsing components. The advisory provides updated packages to remediate these issues.

The vulnerabilities collectively can cause denial of service conditions through excessive resource consumption or memory exhaustion, incorrect TLS session resumption potentially affecting secure communications, improper parsing of IPv6 literals which may affect network functionality, and symlink traversal that could lead to unauthorized file permission changes. These impacts affect the reliability and security of network and TLS operations within affected Red Hat Enterprise Linux 10.0 systems using gvisor-tap-vsock.

An updated version of gvisor-tap-vsock is available from Red Hat for Enterprise Linux 10.0 Extended Update Support that addresses these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:17084 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.