Security update for google-cloud-sap-agent
This update for google-cloud-sap-agent fixes the following issues: Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272128). - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279304). - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279201). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278987). Non security issue fixed: - re-enable stripping and debuginfo (bsc#1210938).
AI Analysis
Technical Summary
CVE-2026-56852 is a denial of service vulnerability in the golang.org/x/text library's norm.Iter component. When processing input containing invalid UTF-8 bytes, norm.Iter can enter an infinite loop, leading to resource exhaustion and application unresponsiveness. This flaw affects Red Hat Hardened Images RPMs including golang1.26 packages. Red Hat has issued a security advisory (RHSA-2026:49360) describing the issue but currently does not provide a patch or mitigation that meets their standards. The vulnerability is identified as CWE-835 (Loop with Unreachable Exit Condition).
Potential Impact
The vulnerability allows a remote attacker to cause a denial of service by providing specially crafted invalid UTF-8 input to applications using the affected golang.org/x/text norm.Iter functionality. This results in an infinite loop, causing high CPU and memory consumption and rendering the application unresponsive. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Currently, Red Hat does not offer a fix or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories and update when a fix becomes available. Until then, consider limiting exposure to untrusted input that could trigger this vulnerability if possible.
Security update for google-cloud-sap-agent
Description
This update for google-cloud-sap-agent fixes the following issues: Security issues fixed: - CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272128). - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279304). - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279201). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278987). Non security issue fixed: - re-enable stripping and debuginfo (bsc#1210938).
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56852 is a denial of service vulnerability in the golang.org/x/text library's norm.Iter component. When processing input containing invalid UTF-8 bytes, norm.Iter can enter an infinite loop, leading to resource exhaustion and application unresponsiveness. This flaw affects Red Hat Hardened Images RPMs including golang1.26 packages. Red Hat has issued a security advisory (RHSA-2026:49360) describing the issue but currently does not provide a patch or mitigation that meets their standards. The vulnerability is identified as CWE-835 (Loop with Unreachable Exit Condition).
Potential Impact
The vulnerability allows a remote attacker to cause a denial of service by providing specially crafted invalid UTF-8 input to applications using the affected golang.org/x/text norm.Iter functionality. This results in an infinite loop, causing high CPU and memory consumption and rendering the application unresponsive. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Currently, Red Hat does not offer a fix or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories and update when a fix becomes available. Until then, consider limiting exposure to untrusted input that could trigger this vulnerability if possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:49360
- Cve Count
- 1
- State
- PUBLISHED
Threat ID: 6a74cf8ebf8831d5391aebfa
Added to database: 08/06/2026, 18:16:46 UTC
Last enriched: 08/13/2026, 19:45:58 UTC
Last updated: 09/21/2026, 22:01:35 UTC
Views: 42
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.