Security Fix(es):

* golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate
certificates (CVE-2026-111943)

* golang: golang crypto/x509: Denial of Service via excessive processing of
DNS SAN entries (CVE-2026-27145)

* golang: Go encoding/asn1: Denial of Service via excessive recursion in
Unmarshal (CVE-2026-33818)

* golang: Golang MIME: Denial of Service via maliciously-crafted MIME
header (CVE-2026-42504)

* golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial
of Service (CVE-2026-56853)

* golang: Go html/template: Cross-Site Scripting via pathological input
(CVE-2026-56858)

* golang: golang net/url: Denial of Service from quadratic complexity in
path resolution (CVE-2026-56860)

* golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate
messages (CVE-2026-56862)

* golang: golang: Denial of Service via crafted HTTP Range headers
(CVE-2026-78667)

* net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of
Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)

* golang: crypto/tls: Denial of Service via multiple ECH outer extension
references (CVE-2026-97031)

* golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

Red Hat Security Advisory: RHOSO 18.0 os-diff security update

Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.

The Red Hat OpenStack Platform (RHOSP) director Operator adds the ability to install and run a RHOSP cloud within OpenShift Container Platform (OCP).

Security Fixes:
* golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
* Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)
* golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)
* Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs (CVE-2026-46597)
* Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
* Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
* Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
* golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)

Enhancements:
* This release of OSPdO includes support for installation on OpenShift 4.20 platform (RHOSSTRAT-1291)

Bug Fixes:
* osp-director-operator no longer depends on the deprecated kube-rbac-proxy image (OSPRH-25893)

Red Hat Security Advisory: Updated Red Hat OpenStack Platform 17.1 director Operator container images

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container
Platform 4.12.99. See the following advisory for the container images for
this release:

https://access.redhat.com/errata/RHSA-2026:70647

Security Fix(es):

None

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

All OpenShift Container Platform 4.12 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.

Red Hat Security Advisory: OpenShift Container Platform 4.12.99 packages and security update

Red Hat Edge Manager (RHEM) provides simple, scalable, and security-focused
management of edge devices and applications. It supports image-mode RHEL and
container workloads that run on Podman/Docker or Kubernetes.

RHEM is now available as a standalone feature, providing greater flexibility for
edge deployments. In addition to the standalone version, RHEM continues to be
offered as a plugin for the following platforms:

Red Hat Advanced Cluster Management (RHACM): Extends fleet management to edge
devices.
Red Hat Ansible Automation Platform (AAP): Integrates edge management with
Ansible automation.

This integration enables organizations to optimize the management and
orchestration of their fleets of edge devices; whether its thousands of
dispersed retail point-of-sale systems or industrial machinery on remote factory
floors.

Value for customers and partners:

* This solution not only helps customers manage thousands of devices but helps
scale operations.
* To manage large-scale deployments, customers need to be able to integrate with
their existing management systems, support remote configuration and over-the-air
updates, and collect telemetry data for advanced analytics.
* Red Hat Edge Manager offers a simple and security-focused lifecycle
management, from onboarding to decommissioning of edge devices.

This complete end-to-end solution empowers organizations to gain the most value
from the fleets of devices that generate data, all from a centralized location.

Security Fixes: 

* flightctl: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
* flightctl: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* flightctl: OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
* flightctl: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)
* flightctl: Arc: Information disclosure and Denial of Service via unauthenticated debug endpoints (CVE-2026-48050)
* flightctl: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)
* flightctl: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
* flightctl: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
* flightctl: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
* flightctl: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* flightctl: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
* flightctl: go-git: Arbitrary file read/write via symbolic link resolution (CVE-2026-71556)

Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update

rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management.

Security Fix(es):

* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: rhc security update

The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.

Red Hat Security Advisory: Red Hat Web Terminal Operator 1.16.1 release.

The External Secrets Operator for Red Hat OpenShift builds on top of Kubernetes, which integrates external secret management systems like AWS Secrets Manager, HashiCorp Vault, Google Secrets Manager, Azure Key Vault, IBM Cloud Secrets Manager, and many more. The operator reads information from external APIs and automatically injects the values into a Kubernetes Secret.

Red Hat Security Advisory: external secrets operator for Red Hat OpenShift 1.1.1

The OpenShift Compliance Operator v1.9.2 is now available.
See the documentation for bug fix information:

https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/compliance-operator#compliance-operator-release-notes

Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update

A worker for yggdrasil that receives Ansible playbooks and executes them against the local host.

Security Fix(es):

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: rhc-worker-playbook security update

Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

Red Hat Security Advisory: Multicluster Global Hub 1.7.2 security update

Host metering service

Security Fix(es):

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: host-metering security update

Red Hat Security Advisory: Multicluster Global Hub 1.8.1 security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: yggdrasil security update

Release of OpenShift Source To Image 1.6.3

Red Hat Security Advisory: OpenShift Source To Image 1.6.3

The RHTAS CLI Stack images for RHTAS 1.4.3

Red Hat Security Advisory: RHTAS 1.4.3 - CLI Stack Release

Red Hat OpenShift Service Mesh 3.4.1, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application.

Security Fix(es):

* CVE-2026-27145 openshift-service-mesh/istio-proxyv2-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14933)
* CVE-2026-27145 openshift-service-mesh/istio-pilot-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14933)
* CVE-2026-27145 openshift-service-mesh/istio-cni-rhel9: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14933)
* CVE-2026-27145 openshift-service-mesh/istio-rhel9-operator: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (OSSM-14933)

Fixes/Improvements:

* Istiod-default-validator points to non-existent istiod Service after OSSM 3.3.4 upgrade when using non-default Istio name with default revision tag (OSSM-14646)

Search: CVE-2026-27145