RHSA-2026:93598HighCVSS 7.5

Red Hat Security Advisory: LVMS 4.17 Bug Fix and Enhancement update

Published
November 2, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (7)

CVE-2025-68121 →CVE-2026-25679 →CVE-2026-32280 →CVE-2026-33811 →CVE-2026-33818 →CVE-2026-56860 →CVE-2026-56862 →

📋 Description

CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

🎯 Affected products10

  • Logical Volume Manager Storage 4.17
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:19b83581bdddda7e9d7a7df60931817b71afd80f7b35f6f626af69af89b0de27_ppc64le as a component of Logical Volume Manager Storage 4.17
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:2550dcf84e73f644e95a82b372f3706613cca67ef3d9b3b38ec1a54b2555d13c_amd64 as a component of Logical Volume Manager Storage 4.17
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:8536c52732c2ac5ea22b9d53597bc011cd656f391f61680df6ec4cb0f5e31417_s390x as a component of Logical Volume Manager Storage 4.17
  • registry.redhat.io/lvms4/lvms-must-gather-rhel9@sha256:be8f832d62d77116e7e0f1e26c2729ba7a2686f5a8a3760b2840dc14cf228d3c_arm64 as a component of Logical Volume Manager Storage 4.17
  • registry.redhat.io/lvms4/lvms-operator-bundle@sha256:7059b2ee2ed6fa31b07456b8a633558361c2a6a63084572fdf48743db147abcc_amd64 as a component of Logical Volume Manager Storage 4.17
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:869dd4b534f4b091a9a4fff1f7eaee1e88ee144d789fc63dac3d1fd7ee131a7f_s390x as a component of Logical Volume Manager Storage 4.17
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:913d6c2bac374363c2e1d4c2863ba24f29b8767e6ec554210007706e6dc93ea7_amd64 as a component of Logical Volume Manager Storage 4.17
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:aab746730269d0322e32582aa5bd8554bae65d286967b704c60a5785483f333f_arm64 as a component of Logical Volume Manager Storage 4.17
  • registry.redhat.io/lvms4/lvms-rhel9-operator@sha256:d4f77f813f1e99b7f4b60a8b16aa3de5c80c2dcfc46c1203ac6b8c00d62011c2_ppc64le as a component of Logical Volume Manager Storage 4.17

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.

🔗 References (10)