Red Hat Security Advisory: host-metering security update

The vulnerability CVE-2026-56860 involves a denial of service condition caused by quadratic complexity in the path resolution logic of the golang net/url package. This flaw affects the host metering service in Red Hat Enterprise Linux, including versions used in Extended Lifecycle Support for RHEL 7 and RHEL 9. The issue can be triggered by specially crafted inputs that cause excessive resource consumption during URL path processing. Red Hat has released security updates to fix this vulnerability, as documented in their advisories RHSA-2026:70191 and RHSA-2026:71619.

Successful exploitation of this vulnerability could allow an attacker to cause a denial of service by consuming excessive CPU or memory resources during URL path resolution in the host metering service. This could disrupt normal operation of the affected service and potentially impact system availability. There are no known exploits in the wild at this time.

Red Hat has released official security updates that address CVE-2026-56860. Users should apply the provided patches for the host-metering and runc packages as detailed in Red Hat advisories RHSA-2026:70191 and RHSA-2026:71619. For detailed update instructions, refer to https://access.redhat.com/articles/11258. Applying these updates will mitigate the vulnerability. No additional action is required beyond applying the official patches.