RHSA-2026:95090CriticalCVSS 7.5

Red Hat Security Advisory: RHACS 4.11.7 security and bug fix update

Published
November 4, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (2)

CVE-2026-114406 →CVE-2026-116591 →

📋 Description

CVE-2026-114406 — ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-116591 — github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

🎯 Affected products48

  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:9eb3d2c368098bd4aee8a95027df8aa4c196b93f1950b50ef5148efd47308c08_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:c6bb1f42bb66ae6f3f1b57bc38626a189b8c60acb1edea7b6fa7e48f716f0e0e_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:d5520239be3c0a1a28e9643afc1b55e7a74b121de3860b47debed7697a104c2c_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:f0f3ea63f860bdd09450615840c4fe1c5020a6b3f8970cce7a08238d05f41bc0_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel9@sha256:5f155128718df5fb3489179de24a8c8da6adcd0e25c38273fb169b8ae228bc9f_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel9@sha256:c109f483c2035a90a02d7293050cfa6c48e5d4e47b8bb38a3a8cff64a6ed43b1_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel9@sha256:d69d09f042c9147a1a278d0d9095f32649ff0295a78b6b58d7b3d2a4b5ab000e_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel9@sha256:fd2bbeb55edfe1e474b2d23cc1afcb6ac844359a1e0ae3e055703b1d864fbdd2_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel9@sha256:11e7886e8cc768e00d0e05ddbc02c40196bdecb493327f4ec21d616dddf4fee1_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel9@sha256:436784504119fd3d0da54c151a46380c804daeaf62b0f6f2a4536358254c31be_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9@sha256:4df46754e982d02dce3698a6fdd9dfc3c53b06300e68d63d551135bd5aa89466_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9@sha256:6ac0bdb6824b512396dbcdc60b0915e11b0003a3649a7cdf1580b920fed16a78_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9@sha256:7bfef70f0aad2469f8dad4f71549ecb98dc6357520ed2c014b831ccc200c1159_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9@sha256:ebcd15c2256c3d6650b832dc6d946fc42e9a0aa2b5d42ade2956db7b8294d38c_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:60f96415252db7fe8e6e03e2468c72226df27a256711af2c38d637d7b97a63fc_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:209f9e79d198625f96c7665166402df0f5645c391b40130355256efb68212def_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:2260377709994d21a9001f15653e58ef326b88a808617c47f4b32fc2d17e4712_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:ac3d9d34d8d85502f2e694609f1aa2f3e3c7be38667ec10d13233742437f9103_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:e97a806d6698f58da778db3e3faeda30e1f0ffdc5080411243559fb5164d49be_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:6e0e0be751bb42822bf7593f2db780a2f4585f78c38deff6d8a6dd6520ca3fbd_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:702a6dba6d15ccb0b8df8d7efa62d07b713a6fa8226be65dceb1de230f07ba88_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:a2eba5ed46f8f28048cfd0517c87fd2f062606ec328331d4915d6dc545ec5c81_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:b28c44d6224a7ed067db2678f763d0926fe808b965d7c918fa8f1d918ea6fd64_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9@sha256:1bbd83ea8b1c5ee2c3af73ec8294cc62bb4494fa4c6da9ca1121a3b5f0badc55_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9@sha256:7aa8318013bd7a8da4c7172220ea09f8aec72c3ebfc88ae51e913ad0d28e8255_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9@sha256:de57bbc118d6a88008ae06a0b5c27eeaa9b123a197d208ce25a9b49bee2a9bdf_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9@sha256:ec3383a842e45c158f8f2a18e2244ff44e2278c545a26b403d491b4c9d28d35e_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel9@sha256:600c9889e1b8651fda538320a42906b87642d634e8ff1bffbbfc9eb59e59e6cb_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-slim-rhel9@sha256:859ada91ea9d687da7b38263a0e5ed920042cf72e6e7259c2a5d0a87708d50dc_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes 4.11
  • +18 more not shown

✅ Remediation

If you are using an earlier version of RHACS, you are advised to upgrade to the version of RHACS mentioned in the synopsis and release notes in order to take advantage of the enhancements, bug fixes, and/or security patches in the release. Workaround: See the security bulletin for a detailed mitigation procedure. Workaround: Reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. No direct configuration-level workaround exists within the library itself. --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounds on parsed count values and decode-table indices in klauspost/compress zstd decompression routines to prevent integer wraparound and out-of-bounds indexing: upgrade to klauspost/compress 1.20.2+ (or the corresponding fixed Red Hat builds), which reject counts exceeding math.MaxInt16 in readNCount, restrict Huffman-weight FSE tableLog values to 6 in huff0.ReadTable, and adjust count validation in validateNorm, closing crafted two-block zstd compressed stream. Until patched, this is a concern on applications decompressing untrusted Zstandard (zstd) input using klauspost/compress DecodeAll or streaming decoder, so reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wraparound defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)

🔗 References (6)