Red Hat Security Advisory: VolSync v0.16 security fixes and container updates

The vulnerability CVE-2026-46603 affects golang.org/x/image/vp8l, a Go package used in VolSync v0.16, a Kubernetes operator for replicating persistent volumes. The flaw allows a remote attacker to cause a denial of service by providing a malicious VP8L image with many unused Huffman tree groups, which triggers excessive memory allocation during image decoding, leading to memory exhaustion. Red Hat has assigned an Important severity rating and released updated VolSync v0.16 images with security fixes. No alternative mitigations meet Red Hat's criteria, so patching is the recommended remediation. The vulnerability impacts availability but does not affect confidentiality or integrity.

This vulnerability can cause denial of service through memory exhaustion in applications processing specially crafted VP8L images. The impact is limited to availability degradation of services using the affected golang.org/x/image/vp8l component within VolSync v0.16. There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

Red Hat has released security fixes and updated container images for VolSync v0.16 to address this vulnerability. Users should upgrade to the fixed versions as per the Red Hat advisory. No other effective mitigations are currently available or recommended by Red Hat. Monitoring or other generic mitigations are not substitutes for applying the official update.