RHSA-2026:36796HighCVSS 9.1

Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update

Published
July 8, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (23)

CVE-2026-33811 →CVE-2026-39821 →CVE-2026-39829 →CVE-2026-39830 →CVE-2026-32280 →CVE-2026-32282 →CVE-2026-33810 →CVE-2026-33815 →CVE-2026-35469 →CVE-2026-46595 →CVE-2025-61729 →CVE-2026-32281 →CVE-2026-33186 →CVE-2026-33816 →CVE-2026-39828 →CVE-2026-39832 →CVE-2026-42154 →CVE-2026-42508 →CVE-2026-25679 →CVE-2026-27137 →CVE-2026-39835 →CVE-2026-42151 →CVE-2026-32283 →

📋 Description

CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27137 — crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32281 — crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32282 — golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33810 — crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33815 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-33816 — github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability CVE-2026-35469 — Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39828 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions CVE-2026-39829 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters CVE-2026-39830 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses CVE-2026-39832 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions CVE-2026-39835 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-42151 — github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API CVE-2026-42154 — github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42508 — golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey CVE-2026-46595 — golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation

🎯 Affected products23

  • RHEM 1.0 for RHEL 9
  • flightctl-0:1.0.3-1.el9em.src as a component of RHEM 1.0 for RHEL 9
  • flightctl-agent-0:1.0.3-1.el9em.aarch64 as a component of RHEM 1.0 for RHEL 9
  • flightctl-agent-0:1.0.3-1.el9em.ppc64le as a component of RHEM 1.0 for RHEL 9
  • flightctl-agent-0:1.0.3-1.el9em.s390x as a component of RHEM 1.0 for RHEL 9
  • flightctl-agent-0:1.0.3-1.el9em.x86_64 as a component of RHEM 1.0 for RHEL 9
  • flightctl-cli-0:1.0.3-1.el9em.aarch64 as a component of RHEM 1.0 for RHEL 9
  • flightctl-cli-0:1.0.3-1.el9em.ppc64le as a component of RHEM 1.0 for RHEL 9
  • flightctl-cli-0:1.0.3-1.el9em.s390x as a component of RHEM 1.0 for RHEL 9
  • flightctl-cli-0:1.0.3-1.el9em.x86_64 as a component of RHEM 1.0 for RHEL 9
  • flightctl-observability-0:1.0.3-1.el9em.aarch64 as a component of RHEM 1.0 for RHEL 9
  • flightctl-observability-0:1.0.3-1.el9em.ppc64le as a component of RHEM 1.0 for RHEL 9
  • flightctl-observability-0:1.0.3-1.el9em.s390x as a component of RHEM 1.0 for RHEL 9
  • flightctl-observability-0:1.0.3-1.el9em.x86_64 as a component of RHEM 1.0 for RHEL 9
  • flightctl-selinux-0:1.0.3-1.el9em.noarch as a component of RHEM 1.0 for RHEL 9
  • flightctl-services-0:1.0.3-1.el9em.aarch64 as a component of RHEM 1.0 for RHEL 9
  • flightctl-services-0:1.0.3-1.el9em.ppc64le as a component of RHEM 1.0 for RHEL 9
  • flightctl-services-0:1.0.3-1.el9em.s390x as a component of RHEM 1.0 for RHEL 9
  • flightctl-services-0:1.0.3-1.el9em.x86_64 as a component of RHEM 1.0 for RHEL 9
  • flightctl-telemetry-gateway-0:1.0.3-1.el9em.aarch64 as a component of RHEM 1.0 for RHEL 9
  • flightctl-telemetry-gateway-0:1.0.3-1.el9em.ppc64le as a component of RHEM 1.0 for RHEL 9
  • flightctl-telemetry-gateway-0:1.0.3-1.el9em.s390x as a component of RHEM 1.0 for RHEL 9
  • flightctl-telemetry-gateway-0:1.0.3-1.el9em.x86_64 as a component of RHEM 1.0 for RHEL 9

✅ Remediation

See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.0 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: To mitigate this issue, review and restrict the assignment of Kubernetes cluster roles `pods/portforward (create)`, `pods/exec (create)`, `pods/attach (create)`, and `nodes/proxy (get/create)` to untrusted users or service accounts. Ensure that only authorized and necessary entities possess these permissions. Modifying RBAC policies can impact the functionality of applications and services that rely on these permissions; careful testing is recommended. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively. Workaround: Upgrade to a fixed golang.org/x/crypto/ssh release via updated golang or package rebuilds. Ensure SSH servers use supported public-key callback configurations with source-address validation as intended.

🔗 References (28)