Threats Tagged 'cve-2026-33811'

Red Hat OpenShift Logging 6.4.6 is a cluster-wide logging solution for OpenShift that collects and manages application, infrastructure, and audit logs. Multiple security vulnerabilities have been identified in this product, tracked under CVE-2026-25681 and nine additional CVEs. These vulnerabilities affect the logging subsystem and have been addressed in the 6.4.6 update. The advisory provides instructions for upgrading and applying the update to mitigate these issues.

Red Hat Developer Hub (RHDH) is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters (AKS, EKS, GKE). The core features of RHDH include a single pane of glass, a centralized software catalog, self-service via golden path templates, and Tech Docs. RHDH is extensible by plugins.

Kiali 2.22.5 for Red Hat OpenShift Service Mesh 3.3 addresses multiple security vulnerabilities including denial of service and arbitrary code execution issues. These vulnerabilities stem from inefficient certificate chain validation, command injection via unescaped line terminators in shell-quote, and unsafe expression generation from crafted protobuf descriptors in protobufjs. The update aims to improve the security posture of the Kiali component used for service mesh observability and management.

This update includes the following RPMs: golang1.25: * golang1.25-1.25.11-2.hum1 (aarch64, x86_64) * golang1.25-bin-1.25.11-2.hum1 (aarch64, x86_64) * golang1.25-docs-1.25.11-2.hum1 (noarch) * golang1.25-misc-1.25.11-2.hum1 (noarch) * golang1.25-src-1.25.11-2.hum1 (noarch) * golang1.25-tests-1.25.11-2.hum1 (noarch) * golang1.25-1.25.11-2.hum1.src (src)

Red Hat OpenShift Service Mesh 3.1.10, which is based on the open source Istio project, addresses a variety of problems in a microservice architecture by creating a centralized point of control in an application. Security Fix(es): * CVE-2026-39820 openshift-golang-builder-container: Go net/mail: Denial of Service via crafted email inputs (OSSM-14266) * CVE-2026-42499 openshift-golang-builder-container: net/mail: Denial of Service via pathological email address parsing (OSSM-14501) * CVE-2026-33814 openshift-golang-builder-container: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame (OSSM-14549) * CVE-2026-33811 openshift-golang-builder-container: Go net package: Denial of Service via long CNAME response in LookupCNAME (OSSM-14562)