RHSA-2026:95576HighCVSS 8.1

Red Hat Security Advisory: Release of containers for RHOSO 18.0.22

Published
November 5, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (10)

CVE-2026-32283 →CVE-2026-42504 →CVE-2026-56853 →CVE-2026-56858 →CVE-2026-56859 →CVE-2026-27145 →CVE-2026-33818 →CVE-2026-56860 →CVE-2026-56862 →CVE-2026-111943 →

📋 Description

CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-42504 — mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products131

  • Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/barbican-rhel9-operator@sha256:8fe76305f9a129b3f6c842b10db1f933f22d98c2a13e1af381a5b36fc2fffbd3_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/cinder-rhel9-operator@sha256:c9b498362c2e173a8658864f7b84682a4417ac39cb0d63515dd01caf4feef3c5_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/designate-rhel9-operator@sha256:339f77b1f0f8a1ddd38bff293696ae0cfcda3311e55b3b86bf4b2e90409af122_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/ee-openstack-ansible-ee-rhel9@sha256:35f04eac43d3210a5d610390d940a284b4730fd505a6c70fd5da3f999bacf976_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/glance-rhel9-operator@sha256:ba9ad5824c9d381d7c5701077e2e5e96092079f5472cbb6f9dd4e09b919f05da_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/heat-rhel9-operator@sha256:129c386561a4f612edc493a2bbe0fbec0b11940419c91625dafdd544c0397024_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/horizon-rhel9-operator@sha256:1b73b8f46a8bb74dfd6404df684790783720c1db52f3d4c513429628ec454b63_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/infra-rhel9-operator@sha256:bbb2ac2083fa3a42ec2ef110cf39c149802569cafbf669db68d80d9d70c57827_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/ironic-rhel9-operator@sha256:6fb96bd3ca2f6a58e8b580a14f73fbba2955d448334cdc19f67334f9d32c2f24_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/keystone-rhel9-operator@sha256:8929c4ab16e275fc17a77223be3f27914c1bb7e04a308d8009ac98cd2bf9f0b3_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/manila-rhel9-operator@sha256:e529bd2664858c48b4741e1be4963fa94b4c990c025a5a22780db89069d85ef2_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/mariadb-rhel9-operator@sha256:ebacaafb76b1dfe8e2c683bde065b8b7776b45d0a6df58e50ba5b5e539b6f680_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/mysqld-exporter-rhel9@sha256:a5461f33b1d619402ec7b47bb85a84adfe23ea71f3f084e8569c2b352ddf0408_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/neutron-rhel9-operator@sha256:85e1b492759d3a2d6d6d0d025174e3daa7c0db3e67122d4be5349f6ba3f6c450_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/nova-rhel9-operator@sha256:1ff0379e0696eb1b77402aad267e2cb62c9bf356027073868c5207cccba36e68_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/octavia-rhel9-operator@sha256:224e2c1435a5f2e639884dfee9a36d171b8032f5b8e4601e885be241bd664b7c_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-baremetal-agent-rhel9@sha256:b64b0f4d9a9ee79c74da5662c74e813778a04e8d7ba26e5372d23e42d32cd847_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-baremetal-rhel9-operator@sha256:463da2994e61d278d89a0269a2a59c7f6fd91f2600345476014a1eea7cfa1b1b_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-must-gather-rhel9@sha256:f57b064868338e1d4359d90cb68b2ce70c1e42dc3d0379acac7e900b47186640_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-network-exporter-rhel9@sha256:543b884d8fa76385fc82a8f2ff4926dee4d15698d5ba5000dc7711490c6fd861_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-operator-bundle@sha256:5d4cc7c93d9c80118bc36732cd0ae0661caa5e8dfb4096e07b4d89f4267a0f5f_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/openstack-rhel9-operator@sha256:558675f3ccaae547ac095fdcd008f4539ff0c78c428bf284e422a7f8c2d99ec7_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/ovn-rhel9-operator@sha256:bedc1a15705b8c958fb7d5194b0bc934d698590ff834f4ab6a7f384938fb77cd_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/prometheus-podman-exporter-rhel9@sha256:6ed6fbcc8724f0530d5d9b26cc9536efafd96ddfbf06bd71cbed9fb2f6359cec_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/sg-core-rhel9@sha256:8604748cdc843d4adb29503ebc6c9390fe6c10d43dcf16368dd9936a0a7cb89d_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/swift-rhel9-operator@sha256:2ac207db87b46e25b8af9b0a16ebb1e7d14743ff167e134d9e718afd9456a46f_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/telemetry-rhel9-operator@sha256:552e75abe128c747abddae577545295b69fc0af624dfe57eca49660a316e4e94_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/test-rhel9-operator@sha256:b5ef789786375f535d583e55e2c52a729b8a786b0d3456143542af8847a5850a_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • registry.redhat.io/rhoso-operators/watcher-rhel9-operator@sha256:ddb27e15e9aed497a5c99bd59601650e5302de8a8ed89086f3ed3c9f65ce60b7_amd64 as a component of Red Hat OpenStack Services on OpenShift 18.0
  • +101 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update as a new RHOSO 18.0 deployment, see “Deploying Red Hat OpenStack Services on OpenShift” at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/deploying_red_hat_openstack_services_on_openshift/index For details on how to apply this update to an existing RHOSO 18.0 deployment, see “Updating your environment to the latest maintenance release” at https://docs.redhat.com/en/documentation/red_hat_openstack_services_on_openshift/18.0/html/updating_your_environment_to_the_latest_maintenance_release/index Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (14)