Red Hat has issued a security update for the skopeo command, which is used to inspect container images and registries. The update addresses multiple vulnerabilities in underlying Go libraries, including denial of service via pathological email parsing, excessive recursion in ASN.1 unmarshalling, quadratic complexity in URL path resolution, denial of service in unencrypted HTTP/2 connections, cross-site scripting via pathological input, and denial of service via indefinite TLS KeyUpdate messages. These vulnerabilities collectively pose risks of denial of service and cross-site scripting attacks. The update is rated as Important by Red Hat and applies to Red Hat Enterprise Linux 10 and its variants.

Red Hat Security Advisory: skopeo security update

Red Hat Multiarch Tuning Operator version 1.3.4 addresses multiple security issues by restricting excessive permissions previously granted to Operator and pod placement controller ServiceAccounts. The update limits Secret access, restricts MutatingWebhookConfiguration modifications to only those managed by the Operator, and confines write permissions on ClusterRoles and RoleBindings to operand resources. Additional fixes include preventing unauthorized directory creation via hostPath mounts, improving cache key collision resistance, and validating architecture strings and error messages before writing to pod metadata. These changes mitigate risks related to privilege escalation and unauthorized resource manipulation.

Red Hat Security Advisory: Red Hat Multiarch Tuning 1.3.4

Multiple denial of service vulnerabilities have been identified in the Red Hat rhc client tool and daemon, which connects systems to Red Hat hosted services for system and subscription management. The vulnerabilities stem from issues in Go language libraries used by rhc, including excessive recursion in ASN.1 unmarshalling, quadratic complexity in URL path resolution, unencrypted HTTP/2 connections, and indefinite TLS KeyUpdate messages. Red Hat has released an important security update addressing these issues for Red Hat Enterprise Linux 8 and its extended life cycle variants.

Red Hat Security Advisory: rhc security update

Red Hat has issued a security advisory for the buildah package, which facilitates building OCI container images. The update addresses multiple vulnerabilities in underlying Go libraries, including denial of service issues via excessive recursion, quadratic complexity in URL path resolution, unencrypted HTTP/2 connection handling, indefinite TLS KeyUpdate messages, and a cross-site scripting vulnerability in HTML template processing. These vulnerabilities could impact the stability and security of systems using buildah for container image creation.

Red Hat Security Advisory: buildah security update

Red Hat issued a security advisory for the container-tools module in Red Hat Enterprise Linux 8, addressing multiple vulnerabilities in Go language components used by container tools such as podman, buildah, skopeo, and runc. The fixes address several denial of service issues caused by pathological inputs and recursion, as well as a cross-site scripting vulnerability. The update is rated as Important by Red Hat Product Security.

Red Hat Security Advisory: container-tools:rhel8 security update

This Red Hat security advisory addresses multiple denial of service vulnerabilities in the golang libraries used by the rhc client tool and daemon. The issues include excessive recursion in encoding/asn1 Unmarshal (CVE-2026-33818), quadratic complexity in net/url path resolution (CVE-2026-56860), and indefinite KeyUpdate messages in crypto/tls (CVE-2026-56862). These flaws could allow denial of service conditions when processing specially crafted inputs.

This advisory addresses multiple security vulnerabilities in the Grafana plugin for Performance Co-Pilot, which integrates various data sources and dashboards. The issues include several denial of service (DoS) vulnerabilities in Go language components such as MIME header parsing, ASN.1 unmarshalling, HTTP/2 handling, and TLS key update processing, as well as a cross-site scripting (XSS) vulnerability in the Go html/template package. These vulnerabilities could be exploited to disrupt service or execute malicious scripts. No specific affected versions or patches are detailed in the provided information.

Red Hat Security Advisory: grafana-pcp security update

Multiple denial of service and cross-site scripting vulnerabilities have been identified in the Grafana plugin for Performance Co-Pilot, which includes datasources for scalable time series and dashboards. These issues stem from underlying Golang libraries such as mime, encoding/asn1, net/url, net/http, html/template, and crypto/tls. The vulnerabilities include denial of service via malicious MIME headers, excessive recursion in ASN.1 unmarshalling, quadratic complexity in URL path resolution, unencrypted HTTP/2 connection issues, cross-site scripting via pathological input, and denial of service via indefinite TLS KeyUpdate messages. Red Hat has issued an important security update for grafana-pcp on Red Hat Enterprise Linux 8 to address these issues.

The Grafana plugin for Performance Co-Pilot (pcp) received a security update addressing multiple vulnerabilities in underlying Go libraries. These include denial of service issues via excessive recursion in ASN.1 unmarshalling, quadratic complexity in URL path resolution, denial of service from indefinite TLS KeyUpdate messages, and a cross-site scripting vulnerability in HTML template processing. The update mitigates these issues to improve the security posture of the plugin.

This Red Hat security advisory addresses multiple vulnerabilities in the rhc client tool and daemon, which connects systems to Red Hat hosted services for system and subscription management. The fixes cover denial of service issues in Go's encoding/asn1 and crypto/tls packages, a denial of service due to quadratic complexity in net/url path resolution, and a cross-site scripting vulnerability in html/template. These vulnerabilities could impact the reliability and security of systems using rhc.

Multiple denial of service (DoS) vulnerabilities and one cross-site scripting (XSS) vulnerability have been identified in Grafana, an open source metrics dashboard and graph editor. These issues stem from underlying Go language libraries such as net/mail, encoding/asn1, net/url, net/http, html/template, crypto/tls, and encoding/xml. The vulnerabilities include DoS via pathological email parsing, excessive recursion, quadratic complexity in URL path resolution, unencrypted HTTP/2 connections, indefinite TLS KeyUpdate messages, and XML decoding recursion depth. An XSS vulnerability is also present via pathological input in html/template. Red Hat has issued an important security update for Grafana in Red Hat Enterprise Linux 10 to address these issues.

Red Hat Security Advisory: grafana security update

CVE-2026-33818 is a denial of service vulnerability in the Go encoding/asn1 package used by Red Hat Developer Hub. An attacker can supply a specially crafted, deeply nested ASN.1 structure that causes excessive recursion during unmarshalling, leading to stack exhaustion and service unavailability. This flaw can be triggered remotely without authentication. Red Hat Developer Hub 1.10.4 addresses multiple bugs but no specific fix for this vulnerability is currently available. Mitigations are either unavailable or do not meet Red Hat's criteria for deployment and stability.

Red Hat Security Advisory: Red Hat Developer Hub 1.10.4 release.

Red Hat has issued a security update for osbuild-composer, a service used to build customized OS artifacts including VM images and OSTree commits. The update addresses multiple vulnerabilities in underlying Golang libraries that could lead to denial of service and cross-site scripting attacks. These include issues in net/mail, encoding/asn1, net/url, net/http, html/template, crypto/tls, and encoding/xml packages. The vulnerabilities affect Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. The update is rated as Important by Red Hat Product Security.

Red Hat Security Advisory: osbuild-composer security update

Red Hat has issued an important security update for osbuild-composer, a service used to build customized OS artifacts including VM images and OSTree commits. The update addresses multiple vulnerabilities in underlying Golang libraries, including several denial of service (DoS) issues via pathological inputs in net/mail, encoding/asn1, net/url, net/http, crypto/tls, and encoding/xml packages, as well as a cross-site scripting (XSS) vulnerability in html/template. These vulnerabilities could allow attackers to cause service disruption or execute malicious scripts. The update is available for Red Hat Enterprise Linux 9.4 variants and related products.

Red Hat has issued a security update for osbuild-composer, a service used to build customized OS artifacts including VM images and OSTree commits. The update addresses multiple vulnerabilities in underlying Golang libraries that could lead to denial of service and cross-site scripting issues. These include denial of service via pathological email parsing, excessive recursion in ASN.1 unmarshalling, quadratic complexity in URL path resolution, unencrypted HTTP/2 connection issues, indefinite TLS KeyUpdate message handling, and XML decoding recursion depth problems. A cross-site scripting vulnerability in the html/template package is also fixed. The update is rated as important by Red Hat Product Security and affects Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and related variants.

Multiple denial of service vulnerabilities have been identified in various Go language packages used by the golang-github-openprinting-ipp-usb component, which provides an HTTP reverse proxy backed by IPP-over-USB connections for driverless USB device support. These vulnerabilities include issues in MIME header parsing, ASN.1 unmarshalling, URL path resolution, HTTP/2 unencrypted connections, TLS KeyUpdate message handling, and XML decoding recursion. Red Hat has issued an important security update for Red Hat Enterprise Linux 10 to address these issues.

Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update

The golang packages provide the Go programming language compiler.

Security Fix(es):

* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: golang security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. 

Security Fix(es):

* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)

* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)

* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)

* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)

* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)

* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)

* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Search: CVE-2026-33818