Threats Tagged 'cve-2026-27144'

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143) Bug Fix(es) and Enhancement(s): * Update Go to version 1.25.9+2 [rhel-9.2.z] (JIRA:RHEL-182118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The golang packages provide the Go programming language compiler. Security Fix(es): * crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143) Bug Fix(es) and Enhancement(s): * Update Go to version 1.25.9+2 [rhel-9.2.z] (JIRA:RHEL-182118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Kiali 1.73.25, for Red Hat OpenShift Service Mesh 2.6, provides observability for the service mesh by offering a visual representation of the mesh topology and metrics, helping users monitor, trace, and manage efficiently Security Fix(es): * kiali-ossmc-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031) * kiali-rhel9: node-forge ASN.1 Unbounded Recursion (CVE-2025-66031) * kiali-ossmc-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756) * kiali-rhel9: glob CLI: Command injection via -c/--cmd executes matches with shell:true (CVE-2025-64756)

Red Hat OpenShift Service Mesh 3.3.3, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Security Fix(es): * istio-proxyv2-rhel9: Possible memory corruption after bound check elimination (CVE-2026-27143) * istio-pilot-rhel9: Possible memory corruption after bound check elimination (CVE-2026-27143) * istio-cni-rhel9: Possible memory corruption after bound check elimination (CVE-2026-27143) * istio-rhel9-operator: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-proxyv2-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-pilot-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-cni-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-rhel9-operator: Denial of service in certificate chain building when using Go applications (CVE-2026-32280) * istio-pilot-rhel9: Denial of service in certificate chain building when using Go applications (CVE-2026-32280) * istio-cni-rhel9: Denial of service in certificate chain building when using Go applications (CVE-2026-32280) Fixes/Improvements: * OSSM 3 Operator icon missing from OperatorHub catalog in OCP console (OSSM-13028) * Applying proxy configuration takes a long time on the FIPS cluster (OSSM-12929) * Revert changes done for OSSM-12845 (OSSM-13222) * Revert changes done for OSSM-12930 (OSSM-13223)

Red Hat OpenShift Service Mesh 3.2.5, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Fixes/Improvements: * OSSM 3 Operator icon missing from OperatorHub catalog in OCP console (OSSM-13028) Security Fix(es): * istio-rhel9-operator: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-proxyv2-rhel9: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-pilot-rhel9: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-cni-rhel9: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-rhel9-operator: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-proxyv2-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-pilot-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-cni-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-rhel9-operator: Go: Denial of Service in certificate chain building (CVE-2026-32280) * istio-pilot-rhel9: Go: Denial of Service in certificate chain building (CVE-2026-32280) * istio-cni-rhel9: Go: Denial of Service in certificate chain building (CVE-2026-32280)

Red Hat OpenShift Service Mesh 3.1.8, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Fixes/Improvements: * OSSM 3 Operator icon missing from OperatorHub catalog in OCP console (OSSM-13028) Security Fix(es): * istio-rhel9-operator: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-proxyv2-rhel9: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-pilot-rhel9: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-cni-rhel9: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-rhel9-operator: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-proxyv2-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-pilot-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-cni-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-rhel9-operator: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * istio-pilot-rhel9: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * istio-cni-rhel9: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

Red Hat OpenShift Service Mesh 3.0.11, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Fixes/Improvements: * OSSM 3 Operator icon missing from OperatorHub catalog in OCP console (OSSM-13028) Security Fix(es): * istio-rhel9-operator: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-proxyv2-rhel9: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-pilot-rhel9: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-cni-rhel9: possible memory corruption after bound check elimination (CVE-2026-27143) * istio-rhel9-operator: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-proxyv2-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-pilot-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-cni-rhel9: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * istio-rhel9-operator: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * istio-pilot-rhel9: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * istio-cni-rhel9: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

The golang packages provide the Go programming language compiler. Security Fix(es): * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144) * cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140) * golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.55. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:34097 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/