Threats Tagged 'cve-2026-25680'

The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

OpenShift API for Data Protection (OADP) enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes.

Multiple security vulnerabilities affecting the cosign tool and related Go cryptography libraries have been identified and fixed. These include issues parsing HTML files, a memory-safety vulnerability, and multiple issues in golang.org/x/crypto/ssh. The vulnerabilities have been addressed in updated versions provided by SUSE and Red Hat. A patch is available to remediate these issues.

CVE-2026-25680 is a vulnerability in the golang.org/x/net/html package where parsing arbitrary HTML can lead to excessive CPU consumption. This inefficient algorithmic complexity issue can cause denial of service by exhausting system resources. The vulnerability has a CVSS score of 6.5, indicating medium severity. There is no information about an available patch or official remediation at this time. No known exploits are reported in the wild.

Submariner enables direct networking between pods and services on different Kubernetes clusters that are either on-premises or in the cloud. For more information about Submariner, see the Submariner open source community website at: https://submariner.io/. This advisory contains bug fixes and enhancements to the Submariner container images. Security fix(es): * quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux (CVE-2024-53259) * golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336) * crypto/internal/nistec: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866) * golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (CVE-2025-22868) * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)