The Red Hat Trusted Artifact Signer (RHTAS) 1.3.5 release supports OpenShift Container Platform versions 4.16 to 4.21. This advisory references three CVEs: CVE-2026-4660, CVE-2026-32280, and CVE-2026-33810. CVE-2026-32280 is a denial of service vulnerability in the Go standard library's crypto/x509 and crypto/tls packages, where excessive intermediate certificates can cause uncontrolled resource consumption during certificate chain building. This can lead to service unavailability. The advisory does not provide specific fixes for these CVEs. The vulnerabilities are linked to CWEs including CWE-22 (Path Traversal), CWE-770 (Allocation of Resources Without Limits or Throttling), and CWE-1289. The Red Hat advisory classifies the severity as high but does not indicate an official patch or remediation at this time.

The primary impact is a denial of service condition caused by resource exhaustion when processing untrusted TLS certificates with excessive intermediate certificates. This can make affected systems or applications unavailable to legitimate users. The vulnerabilities may also include path traversal and other resource allocation issues, potentially affecting the integrity of software supply chain operations relying on RHTAS. No known exploits in the wild have been reported.

The vendor advisory does not list any fixes or patches currently available for these vulnerabilities. Patch status is not yet confirmed — check the Red Hat advisory (RHSA-2026:24478) for current remediation guidance. Users should monitor Red Hat communications for updates. Since this is a self-managed on-premise deployment, administrators should consider limiting exposure to untrusted certificate inputs and follow best practices for securing the software supply chain. No vendor-provided mitigations or workarounds are explicitly stated in the advisory.