The Red Hat security advisory RHSA-2026:17084 addresses multiple vulnerabilities in gvisor-tap-vsock, a Go-based replacement for libslirp and VPNKit. The fixed issues include denial of service via crafted certificates (CVE-2025-61729), memory exhaustion in URL query parsing (CVE-2025-61726), unexpected TLS session resumption (CVE-2025-68121), incorrect IPv6 host literal parsing (CVE-2026-25679), symlink traversal in Root.Chmod (CVE-2026-32282), denial of service via multiple TLS 1.3 key update messages (CVE-2026-32283), and denial of service in certificate chain building (CVE-2026-32280). These vulnerabilities affect the Go crypto and networking libraries embedded in gvisor-tap-vsock, potentially impacting resource consumption and security validation. The advisory covers Red Hat Enterprise Linux 10.0 Extended Update Support across multiple architectures.

The vulnerabilities collectively can lead to denial of service conditions through excessive resource consumption or memory exhaustion, incorrect handling of TLS sessions potentially affecting secure communications, and improper parsing of network addresses that could cause unexpected behavior. Additionally, a symlink traversal flaw in file permission changes could allow unauthorized file system modifications. These issues may degrade service availability or compromise security validation in affected systems running gvisor-tap-vsock.

Red Hat has released an important security update for gvisor-tap-vsock in Red Hat Enterprise Linux 10.0 Extended Update Support. Users should apply the update as detailed in the Red Hat advisory RHSA-2026:17084 and the referenced article https://access.redhat.com/articles/11258 to remediate these vulnerabilities. No additional mitigation steps are indicated beyond applying the official update.