The vulnerability CVE-2026-33811 resides in the Golang MIME package included in Red Hat Hardened Images RPMs. It allows a remote attacker to trigger excessive CPU consumption by sending a MIME header containing numerous invalid encoded-words, resulting in a denial of service condition. The issue is classified under CWE-1050 (Excessive Platform Resource Consumption within a Loop). Red Hat has released an update for golang1.25 RPMs (version 1.25.11-2.hum1) addressing this and related issues. The advisory references multiple CVEs fixed in this update but does not explicitly confirm the patch status for CVE-2026-33811. The vendor recommends restricting network access to services processing MIME headers from untrusted sources and implementing input validation and sanitization.

This vulnerability can cause a denial of service by exhausting CPU resources on systems processing malicious MIME headers. It impacts service availability but does not affect confidentiality or integrity. There are no known exploits in the wild. The severity is rated high by Red Hat due to the potential for service disruption.

Red Hat provides updated golang1.25 RPM packages that include fixes for this vulnerability. Users should apply these updates as per Red Hat's guidance at https://images.redhat.com/. Additionally, restrict network access to services that process MIME headers from untrusted sources and implement input validation and sanitization to prevent processing of maliciously crafted MIME headers. Patch status is not explicitly confirmed in the advisory; check Red Hat's official errata for the latest remediation information.