Threats Tagged 'cve-2026-73500'

Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20 and 4.21

The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20 and 4.21

A security vulnerability identified as CVE-2026-73500 affects the tempo package. The issue is addressed in tempo version 2.10.8-r2, which includes the necessary security fixes. Versions prior to 2.10.8-r2 are vulnerable. No CVSS score or detailed technical impact information is provided.

Metrics-server version 0.9.0-r1 addresses two security vulnerabilities including CVE-2026-73500. The update fixes issues present in all versions prior to 0.9.0-r1. No CVSS score is provided for these vulnerabilities. There are no known exploits in the wild at this time.

A vulnerability in etcd prior to versions 3.5.33, 3.6.14, and 3.7.1 allows a network attacker to cause unbounded growth of handshake goroutines by opening many TCP connections to the TLS listener and not completing the TLS handshake. This can exhaust memory and cause denial of service, impacting availability of the etcd cluster and dependent systems such as Kubernetes control planes.

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listener_tls.go, each connection handled by tlsListener.acceptLoop spawns a goroutine that blocks indefinitely inside tls.Conn.Handshake() and remains tracked in the pending map. Unbounded goroutine and map growth can exhaust memory in the etcd process, causing loss of availability for the cluster and, when etcd backs Kubernetes, the control plane. This issue is fixed in versions 3.5.33, 3.6.14, and 3.7.1.

A denial of service vulnerability exists in etcd, a distributed key-value store used in Red Hat Hardened Images. The flaw allows a remote attacker to exhaust memory by opening many TCP connections to the etcd TLS listener without completing the TLS handshake, causing unbounded goroutine creation. This leads to resource exhaustion and denial of service for the etcd cluster and the Kubernetes control plane it supports. Red Hat has released an update including etcd version 3.7.1-0.1.hum1 to address this issue. Mitigation includes restricting network access to the etcd TLS listener to trusted clients and networks and configuring firewall rules to limit inbound connections to authorized hosts. No known exploits are reported in the wild at this time.

This update includes the following RPMs: etcd: * etcd-3.7.1-0.1.hum1 (aarch64, x86_64) * etcd-3.7.1-0.1.hum1.src (src)

VolSync v0.15 is a Kubernetes operator that enables asynchronous replication of persistent volumes within a cluster, or across clusters. After deploying the VolSync operator, it can create and maintain copies of your persistent data. For more information about VolSync, see: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.16/html/business_continuity/business-cont-overview#volsync or the VolSync open source community website at: https://volsync.readthedocs.io/en/stable/.