RHSA-2026:6428HighCVSS 9.1

Red Hat Security Advisory: Network Observability 1.11.1 for OpenShift

Published
April 2, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (8)

CVE-2026-29063 →CVE-2026-33186 →CVE-2025-61726 →CVE-2025-61728 →CVE-2025-61729 →CVE-2025-68121 →CVE-2026-25639 →CVE-2026-26960 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig CVE-2026-26960 — node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation CVE-2026-29063 — immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

🎯 Affected products26

  • Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:05ced6a12abb5c6156d57cde83a5515f1ba1ae4b4876c20df8e87acf658b55cd_arm64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:30a1eceb88756d6bd6b2a523f4c763e2c17491d921e709b49065c8e1827e7e40_amd64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:a90dd2247b3167d97fae23047e0dadb711b870a402fb6ae1460928e187a4a1f3_s390x as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-cli-rhel9@sha256:b0f982a4b0cf36578c2483d9487e6c6f0343043737e01b6dd1b61778ed915e80_ppc64le as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:03f45691cb47a4afd19a4bb61704f1c38cc6f0fb9f7bcacf4ed3070eecdc02b4_ppc64le as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:115254a3a9f613fbcec875c7e515b638da1e046f6dff8bcb0ce8aeb7bd3bcbb8_arm64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:17faaf94edcd7636ece30fcc7372bdabdc66c5d443b1132c9a15ef6823f57175_s390x as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9@sha256:40512734417b0b3555046f6034e20dc9d834819bb83dbc2e6240bd656a4b2b3b_amd64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:1b0ed12930e073b9d9f10856abd1bf78366123a7c46d0365395ae9ffaccb8cd1_arm64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:222e5ccbdcee7fcddfceda87216a63ea8aa46efdde0171fd1ba58b5c1e020768_ppc64le as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:3452169eaaeda28a490561e93089374a5e306868e221f68c14dc623de532f152_amd64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-console-plugin-rhel9@sha256:51765514b5b6d1d205a26ad50893d11284256dd0afbd7603370c92242012973c_s390x as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:2f23661c41345f7e7625d961649fdc4432e5e9b546ca807dc50c1b685480d44f_amd64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:880119c62568c07d28fcedfe545b92cb6e4b9e11ffb79f8405214a4810f931f8_s390x as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:9d6bc518588793ff607a20fd94a181c7028c1f7a938b713253bfddef3fbac708_ppc64le as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-ebpf-agent-rhel9@sha256:dc9c1e367526c7a2bae9694c253909f6716be82f89d1ceb9dc3a38528120d518_arm64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:5218256abd119c47e49511a207521013f4e70873f5e1695cd33c7acb236167a3_arm64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:791b6dff77ede837fe03220d73511632b719e3c9668ef1a4a7766c2c9c8fe4b4_ppc64le as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:7e2463af3ff443c98adf0bbfe349c7d9da90c8de34892e41b46627f30623b47a_amd64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-flowlogs-pipeline-rhel9@sha256:a72d7f075a569e1c0ba055ca748f04fa3c6ff889de498faba215174048b9b088_s390x as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-operator-bundle@sha256:325f2d9688ef540088f75b450d209fb8dd6b7b2dfc006f492f7575f3e8678607_amd64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:13ea96ec33fe631eea4970b4d05aaebb101d1e964047cc3cdd8e659eb1329122_amd64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:4a717354ce0dfefb859c61b6088f9e51c9e1679892359ddcbe250697e723618d_arm64 as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:b5778b60be17f7e849b5aff93df89735063e003c27c61bc03abd4b899542a7ae_ppc64le as a component of Network Observability (NETOBSERV) 1.11.1
  • registry.redhat.io/network-observability/network-observability-rhel9-operator@sha256:dc14db47fce0af17e02916369099477a584d52e113e20b47518007aa074b5453_s390x as a component of Network Observability (NETOBSERV) 1.11.1

✅ Remediation

For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.

🔗 References (12)