RHSA-2026:94498HighCVSS 8.2

Red Hat Security Advisory: Red Hat OpenShift API for Data Protection - 1.4.12

Published
November 3, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (16)

CVE-2026-56852 →CVE-2026-56860 →CVE-2026-56862 →CVE-2026-84445 →CVE-2026-33818 →CVE-2026-39834 →CVE-2026-56858 →CVE-2026-63209 →CVE-2026-32283 →CVE-2026-39821 →CVE-2026-41178 →CVE-2026-56853 →CVE-2026-56859 →CVE-2026-27145 →CVE-2026-39833 →CVE-2026-42504 →

📋 Description

CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39833 — golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-42504 — mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests

🎯 Affected products46

  • OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:46c3d624dd4a3ed042d276b7e100ccc2285413ac48f9c2d2edbb481bf387afdd_arm64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:54e78c40665d889717356c4571d82382813805f0ce4c216a34002672b250f0d8_s390x as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:8ca1f5a2db5ada72befb5f44884b42197b1a72a073517e5e5ebd1f458744b792_ppc64le as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-cli-binaries-rhel9@sha256:e28ebd4bd896563c1423c26878968ee3c99a1e6f41c67475d5042592149ca5b3_amd64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:68d20fc71a077f7c916ce1d1be3be77b95fe15d52b004cef645da19e1db24208_arm64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:9a1be78faf5f3e3b3b2ca0ae3046bb16e33c3e09a56a5e526651af6f1fb25e9b_ppc64le as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c12bdaa9ba6d23d2a341695c8a02cbfc34a2ec4fb84d78ea7443765c051b6aa1_amd64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:ead793e660b44208294442d790d0eb3f10d1971fa48ac7de45d061df1665cc07_s390x as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:8d142c301f09d8525dade17d1aa4a6edf51da114eb5cbf9d41ea37e615b8084e_s390x as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:bac32876890402198742f69129a1b0c1c2f0b569f2abf6517054da0a8678e485_arm64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:e945379471cc591e81d5e6e17a3e6951d01bd48b9cc3e7e49d9bd97e588651ac_amd64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f727863d795401285b3079bd8b82d92a0c3a36198e8f1febc998fd27cc7c8f05_ppc64le as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-operator-bundle@sha256:46e75dd37cb3f97e630919596a230eb790b50dda8c58c9b5847fbf46060da1bc_amd64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:5dca08f97661dd55ff70e2691fbdbd21a192555461e7c67c1c6f07569ff3a5bf_amd64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:c993e95227252e263b9af7e6dc8a9c752ae1668b60303397c061369b16ff81b0_arm64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f88b08e5193649e4fb210daea6a2703c1ead4ac12d5b2c58e07b8ac1b98fa81c_s390x as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-rhel9-operator@sha256:fdb25db819bc5ce3e8e909dc45494f4e5537246ccb18448ceb88a676c2ea3907_ppc64le as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:2126e2941ce552017097625d7a61b43e1a754b61eacc0052aafc393b4e8cd383_s390x as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7e002a3716099eb23a6b85ef4a20265cea15e75f450df58d841002d477abc1c4_arm64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:a1bfc85eb744987c65fe87820821a6a1b8706f51f02ba9109ebd5069f5ac625b_ppc64le as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:baa65d74035f053bc90cea7c19f3cf44e1acf8db92793cdf0824c28ef9f094d3_amd64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:1114f83db3e42886c98dd0272469fdb2396af98ffa8d00776172de97f1745bed_amd64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:16a4d2220e131383c46de39539b56d1cb6ec162a89017d39aa7f06311f26d4c9_arm64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:3384d505fd69d322da94e43eaa7b50832f9e28f9d82fe136b3feb6c63418a593_ppc64le as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:baf079df7b5ee4f67b89c14cc76fa8941cb96c50c01a388e51d6b52ab3eb8291_s390x as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:3133a1d918703061ee3ec10444a14e7180908bd37ce21c98c4fb4e749d370e6b_s390x as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:5edec0b5c9495a0a4f519b6c82fbaceddd3f2ae6ac38b04a1fb87dd08f6542cd_amd64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:7a65e895754c073d390abf53259932248e1d325f9c32d9254bbe659a38dfe14b_arm64 as a component of OpenShift API for Data Protection 1.4
  • registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:dc597bc7f2194c6c23da93a0dfaebe0dd4ab8ede33cc323c59301be3a19931da_ppc64le as a component of OpenShift API for Data Protection 1.4
  • +16 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For Red Hat OpenShift API for Data Protection 1.4, see the following documentation for instructions on how to apply this update: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: Update affected Go applications to use golang.org/x/crypto version 0.52.0 or later, which rejects unsupported ConfirmBeforeUse keys instead of silently ignoring the constraint. As a workaround, do not add keys with ConfirmBeforeUse to the in-memory keyring from golang.org/x/crypto/ssh/agent, or use an SSH agent implementation that correctly enforces confirm-before-use. Workaround: To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.

🔗 References (19)