RHSA-2026:26636HighCVSS 8.3

Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.19.0-1 Update

Published
June 17, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (12)

CVE-2026-25679 →CVE-2026-32281 →CVE-2026-33815 →CVE-2026-33816 →CVE-2026-34986 →CVE-2025-61729 →CVE-2025-68121 →CVE-2026-32280 →CVE-2026-32282 →CVE-2026-32283 →CVE-2025-61726 →CVE-2025-61728 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-33815 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-33816 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products30

  • Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:203e064cac29d057717448aea2282faeedf01001c53b613513a2a7c2bc1dc821_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:5f4d6fed84be863e1962eda68910d84a8501fffd8a04fe4506666a0e82fd5ed1_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:afea6445ec7abb46fe47cd62ac037803889fc45d1fff068d444f2f0ea977795f_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9@sha256:fa63696a69c94780f412bca7704716653cc801d1acfd50d5874b9a596ca498b4_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:0ebb907c42d8616b16f7ab34dde6f903396c9542447f86e9ac1134bd2809f376_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:2fb11102cf802c65fc7f02e65ffe39235174261acd40ef643aa283bc9f413da8_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:cff2cc97baf0fdc548aa8c8e71e379d3414bf59ab07a3850a73495a07e2676d7_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9@sha256:fef28d3c1c71923a4ca4845360e30d6ce10049e0cbf17aee7c6936e8577586a9_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9@sha256:1e36af903bff954a9cd4c7df4b39e4e608cbbceec209de779ac3a330c7297d9a_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9@sha256:46c5f3ea8bf9b9e46d57510ef38759f9e4ef7346299a0757d0253d38bb94670f_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9@sha256:76b6f3115f75683c4e667ff7e97e6ff763a20f8d208126e1c578929ee691423b_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9@sha256:a52f8f6b446d0a2037fd576a05438a2dcc0b6a9236f8d3492a2107aab4474bf6_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9@sha256:1e3451cf5047a4c46a88022aeb58ce5cd939c2653b7ece3a4f588d6fac98b97d_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9@sha256:8a3ff37bf8531c90e730f5a95a66006ec3a6e500e2d8e9594d1bf5b7eb47ee81_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9@sha256:9a04175e4f015a63636055ef25c1979cebbd3fab0da1a605c9440f5949f470ef_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9@sha256:b8db747e81a9c6f910b1a7eeaf1fbfd0409caf614bc6ddf60085c0f2a785e0b2_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9@sha256:4766579573cc93a09e419e3db97cc6bcdef2fe5e636a2f61827b65c72be43567_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9@sha256:4bd8487f5cb845237b4d82a8e47be093f5784a79ebdec2a941846fdd996c29b4_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9@sha256:68cc28bec85f0bcfeda1f97fb05fe5c4b3b0cf2b894136b326077b900ee2baf2_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9@sha256:71db2331e64153d5c74139dd903851b4c938fd47fa2d109192a20e29464d5298_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle@sha256:6b3c99042b4e92421149a1abff73e72f7e27d8b54f9cb437bad1adcb522b0a02_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:09d84c608ca161199eebf7b33f00d9cba7f843e8f07f7496d991c525f5667952_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:364c3fa02a182247e175740bd7699b946f32329c8ea8ae5ea21ae0ccc516cabb_amd64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:475c79f752cd0edd372c4835ebf9507b0dfb1693ffbe4b114a661908a53c02e4_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator@sha256:53727f920105c3184ba25a77ad861a29413bc16368f5a432f6e2feaa4c30f379_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:0babd8144a4ec880feb3a51043804bffadb261e46f318728c7878bcb8169628e_ppc64le as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:54b6bdae6abb33e94d6ec8e236cc25e5e775d61557c9ce349b0376e5380d2859_arm64 as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:b875d8b089d99631e2e956f5fff58a3028545c6c7501591ce39fca45f33e62ff_s390x as a component of Custom Metric Autoscaler 2.19
  • registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9@sha256:cfecbaa68944d1ed40c0dab27b1a034ba429badf9572cc367a34f2c1b7ebb1b4_amd64 as a component of Custom Metric Autoscaler 2.19

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (15)