RHSA-2026:95591HighCVSS 8.2

Red Hat Security Advisory: Cluster Observability Operator - 1.5

Published
November 5, 2026
Last Modified
November 13, 2026

🔗 CVE IDs covered (34)

CVE-2026-39834 →CVE-2026-82417 →CVE-2026-84292 →CVE-2026-84445 →CVE-2026-85152 →CVE-2026-87018 →CVE-2026-109869 →CVE-2026-75838 →CVE-2026-77301 →CVE-2026-116591 →CVE-2026-39822 →CVE-2026-56859 →CVE-2026-56862 →CVE-2026-75931 →CVE-2026-76172 →CVE-2026-84304 →CVE-2026-63209 →CVE-2026-56853 →CVE-2026-75899 →CVE-2026-75975 →CVE-2026-84375 →CVE-2026-84961 →CVE-2026-102276 →CVE-2026-102278 →CVE-2026-109829 →CVE-2026-19534 →CVE-2026-39821 →CVE-2026-42504 →CVE-2026-56858 →CVE-2026-56860 →CVE-2026-109383 →CVE-2026-109855 →CVE-2026-27145 →CVE-2026-33818 →

📋 Description

CVE-2026-19534 — undici: undici: Denial of Service via unrequested WebSocket subprotocol CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39822 — golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-39834 — golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write CVE-2026-42504 — mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing CVE-2026-75838 — dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization CVE-2026-75899 — fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding CVE-2026-75931 — fast-uri: fast-uri: Host confusion via skipped IDN canonicalization CVE-2026-75975 — fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization CVE-2026-76172 — fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects CVE-2026-77301 — adm-zip: adm-zip: Denial of Service via uncontrolled memory allocation CVE-2026-82417 — qs: qs: Denial of Service via improper validation in stringify function CVE-2026-84292 — fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization CVE-2026-84304 — google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation CVE-2026-84375 — js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing CVE-2026-84445 — google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests CVE-2026-84961 — undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options CVE-2026-85152 — undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-87018 — undici: undici: Denial of Service via TLS renegotiation with mismatched certificate CVE-2026-102276 — brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns CVE-2026-102278 — brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns CVE-2026-109383 — undici: undici: Certificate validation bypass via dropped TLS options in Agent CVE-2026-109829 — undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching CVE-2026-109855 — undici: undici: Denial of Service via failed HTTP/2 WebSocket handshake CVE-2026-109869 — undici: undici: Denial of Service via unhandled stream error on excessive content encodings CVE-2026-116591 — github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input

🎯 Affected products98

  • Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:1a0563e1572f34ed0d985ce1ef7baee529846a9ef71b5bad7427c149375d9b59_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:693f7465bc971bb5d32fbd9e24e1505ce0eccad1aadcfcc6aea8c70e42b605b9_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:69587179480d0d86f5d26df12ff4f62bdbdca65f648f9f5d3afce33d48f8662d_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/alertmanager-rhel9@sha256:9550c4acdc1e24c51767008ae2401d37e7ea516a2844db9dfd606d91c17de422_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:21232206f4cdab1242320173afe735835e6af78f8e2f19ca089ed720003f7743_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:28b0f3f3e33fa17ceb516327b884fb38b82a92e50d3cf1c90aa9ab758779fc16_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:b88c09e00d252ab40dda355e478a8aa3c4434dc8cfd20dcda8bab10a7e01a2bd_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9@sha256:eb90607a8f967cc8c80715dd32c08291ca72dfaf8df2545a1dd17fab026a4021_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-observability-operator-bundle@sha256:6b207a6e87e9ecc709931ee9ed63db5e63066d351bedfa94328e7e4db81183ac_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:39d16923cfaa308542ce8cc01138d29d5fba833ff80f72dab7a76328899b0d48_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:65d7624cc033c9b6feccb25e6c0d01e423d94cb47478300a6bbb9de34839b5ec_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:cb2c8af29127c130a92c82091f48555e268e20207a11d016dc09c0c9c3a4dc4d_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator@sha256:f552dc0122ccd4447c4fbf9b3f6086923f6278897b11779a0d2a7216559b3337_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:2af526858a3309d8f0c1722580abc56371fce65f5cf90586fc5e5bbf01fed192_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:a0d6f2a93b50c8ce8818a5af474569a07870abcb893961499c1ac16a95b4f624_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:cd47e1f5cdff5216a95ca8ecf184b48c96a3b2abe2ff983120ddba923c348917_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/dashboards-console-plugin-rhel9@sha256:ed2ffeaca5eba7f11c424ced13536659ace323c729abaf7ca63807e0c24b49a9_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:202c7937d409d944786bba53e93dd78dde027a6e13f26d3c0bd2cfa892b1e59f_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:76d76110f6153a646cddaaf81714b4161f65445f8f7a676c429524a19fadced0_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:bf211c9efb0dc47d1be94cd50080bc0fed422b16765895a5611bb2ac76cc16f7_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9@sha256:fa69fbf66626649cea9fd45e1f1141fec122aa7198aed3d65293e8c96cfaab3b_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:518724ab815e68e4e3aae9b83b520a103eac31c1d9bbfe6c37df617463c2344a_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:d4d479b4bc004dc46271a7d484f38a0d4866f3dc4474673165134205e04b1372_s390x as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:e8b1128ac052f864bf02a498d66afef26dd6b412624b5fda876c4aeb702d423d_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9@sha256:eecebf7ef353c7864398793d60a4fd46f5001e6fd243803803fefb5cffa49b4e_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:8be8cdbff4fcbff2df0dd623c8c63fc4781f449b7fc69ef00c4a434cb4815792_arm64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:bcd0429087632d45b83558d3a3a77e4b6e1e2605c18926fdfa95fc59782a5ccf_amd64 as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:f853ca06f593aa31f0e9214e41b8e036ccdd1522e2a83c077eb96dc5635efb33_ppc64le as a component of Cluster Observability Operator 1.5
  • registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9@sha256:fc270ac70e6e47ef0c6ac7d039d952505037366e6ca0ceee10b4ed8d51041c6d_s390x as a component of Cluster Observability Operator 1.5
  • +68 more not shown

✅ Remediation

For Cluster Observability Operator 1.5, see the following instructions to apply this update: https://docs.redhat.com/en/documentation/red_hat_openshift_cluster_observability_operator/1-latest Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. Workaround: To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package. Workaround: To mitigate this vulnerability, avoid using DOMPurify with a custom IN_PLACE sanitization configuration that includes an element-removal hook. Default DOMPurify configurations are not affected by this flaw. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Until updates are available, restrict the processing of user-supplied URIs to trusted sources only, implement strict allowlists for destination hosts (preferably IP-based rather than hostname-based), and apply egress filtering to prevent server-initiated connections to internal networks or cloud metadata services. Workaround: There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams. Workaround: If an immediate upgrade to qs 6.16.0 is not feasible, avoid re-serializing attacker-influenced parsed query or body objects with qs.stringify. Where qs.parse is used directly, set allowPrototypes: false unless prototype keys are required. For Express applications, review whether the default query parser configuration is necessary. Wrapping qs.stringify calls in try/catch can limit impact to individual requests. Workaround: Applications that do not use BalancedPool, or that use it without a custom function-valued connect/tls option, are not affected and require no action. As a workaround until packages are updated, avoid using BalancedPool for any connection that relies on custom TLS certificate validation (e.g. certificate pinning); use Client, Pool, or Agent instead, which are unaffected. The permanent fix is upgrading undici to 7.29.1 or later (7.x line) or 8.10.2 or later (8.x line). Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible to undici 8.10.2 or later. Workaround: Reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. No direct configuration-level workaround exists within the library itself. --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounds on parsed count values and decode-table indices in klauspost/compress zstd decompression routines to prevent integer wraparound and out-of-bounds indexing: upgrade to klauspost/compress 1.20.2+ (or the corresponding fixed Red Hat builds), which reject counts exceeding math.MaxInt16 in readNCount, restrict Huffman-weight FSE tableLog values to 6 in huff0.ReadTable, and adjust count validation in validateNorm, closing crafted two-block zstd compressed stream. Until patched, this is a concern on applications decompressing untrusted Zstandard (zstd) input using klauspost/compress DecodeAll or streaming decoder, so reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wraparound defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)

🔗 References (37)