The DevWorkspace Operator extends OpenShift to provide DevWorkspace support.

Red Hat Security Advisory: rhc-worker-script security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: osbuild-composer security update

Collector with the supported components for a Red Hat build of OpenTelemetry

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: opentelemetry-collector security update

The golang packages provide the Go programming language compiler.

Security Fix(es):

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: golang security update

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: git-lfs security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: podman security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update

See the release notes (link in the references section) for a
description of the fixes and enhancements in this particular release.

Red Hat Security Advisory: RHACS 4.9.6 security and bug fix update

Red Hat OpenShift Service Mesh 2.6.15, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Security Fix(es):
* istio-operator-rhel8: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* istio-cni-rhel8: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* pilot-rhel8: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* ratelimit-rhel8: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* istio-cni-rhel8: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* pilot-rhel8: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* istio-rhel8-operator: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

* istio-cni-rhel8: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

* pilot-rhel8: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

* ratelimit-rhel8: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

* istio-rhel8-operator: possible memory corruption after bound check elimination (CVE-2026-27143)

* istio-cni-rhel8: possible memory corruption after bound check elimination (CVE-2026-27143)

* pilot-rhel8: possible memory corruption after bound check elimination (CVE-2026-27143)

* ratelimit-rhel8: possible memory corruption after bound check elimination (CVE-2026-27143)

* istio-rhel8-operator: no-op interface conversion bypasses overlap checking (CVE-2026-27144)

* istio-cni-rhel8: no-op interface conversion bypasses overlap checking (CVE-2026-27144)

* pilot-rhel8: no-op interface conversion bypasses overlap checking (CVE-2026-27144)

* ratelimit-rhel8: no-op interface conversion bypasses overlap checking (CVE-2026-27144)

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.6.15

rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.2

Red Hat OpenShift Service Mesh 3.0.10, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Fixes/Improvements:

Security Fix(es):

* istio-rhel9-operator: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* istio-cni-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* istio-pilot-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* istio-proxyv2-rhel9: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* istio-proxyv2-rhel9: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* istio-proxyv2-rhel9: BuildKit: Arbitrary file write and code execution via untrusted frontend (CVE-2026-33747)

* istio-proxyv2-rhel9: BuildKit: Unauthorized file access via Git URL fragment subdir components (CVE-2026-33748)

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.0.10

An update is now available for Red Hat Lightspeed (formerly Insights) for Runtimes on RHEL 9.

Security fix(es):

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: Red Hat Lightspeed (formerly Insights) for Runtimes security update

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: delve security update

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Search: CVE-2026-25679