RHSA-2026:95612HighCVSS 8.2

Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update

Published
November 5, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (21)

CVE-2026-33818 →CVE-2026-39820 →CVE-2026-39821 →CVE-2026-42504 →CVE-2026-56853 →CVE-2025-61726 →CVE-2026-42499 →CVE-2026-56862 →CVE-2025-61729 →CVE-2026-27136 →CVE-2026-33814 →CVE-2026-63209 →CVE-2026-27145 →CVE-2026-32283 →CVE-2026-39822 →CVE-2026-56858 →CVE-2026-56859 →CVE-2026-56860 →CVE-2026-25679 →CVE-2026-32280 →CVE-2026-33811 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-27136 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27145 — crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-33811 — net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33814 — net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-39820 — net/mail: golang: Go net/mail: Denial of Service via crafted email inputs CVE-2026-39821 — golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39822 — golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-42499 — net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42504 — mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages CVE-2026-63209 — github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing

🎯 Affected products18

  • OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:16eb471eca9c0b2b0d96ed34b83817078ddd473dde369987e93a67378b96fab7_ppc64le as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:48ad2c1e45e13d8c6658d82a606ecb5faca887f3d5a711ef0c3ae15fa008fd9b_arm64 as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:527cc2398dae5b9585f187bf7c61290ff14a6199c2a47ba8858d1253f0451d00_amd64 as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:b1be7a575fe7288c6dc7f7d93cf0c5cfe89d70f73c0541021bbabc715d61e6b2_s390x as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:0388aa8654a7f925d67d4550c60aa6fd4199f263ad96476f4c2d714568e1030f_amd64 as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:6bcf08d9201fd30680f309189d2b6b1840de0071ec32c0853b563953f5cd4c77_arm64 as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:f701e249f99713e579a916dffbd7c65f122e798bbe2fc311019605b2bc9bd26e_s390x as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:fca5def8ff454e9693a76c22f2d93a0942eebe71005b6b5e58d3e1669e386bdd_ppc64le as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:0bbc1a78bcdff21681e746d0e6d350653b84f6317b4bf99b2c113b7179f62bc2_amd64 as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:1eb586e0e232e975ed6b3915d118752426863118f44540ecee4c8e59d7cd624a_s390x as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:6152457c5ef9462d09e9021ed870914bc0ce3274e2dd4b484e50d3c9bc281987_ppc64le as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:96816af9baec3bb0dd023af20db7fe17ab5a309d3afa8dd270561f9759a4d7ac_arm64 as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:9ea8337449c37cb2a948043a09f54305be3b9cea9704e144d91ee08a201d70b8_amd64 as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:02bf479782fdd0270e6e532dea3bc736678d53778014678fe66bb2a46ed45a3d_ppc64le as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:2bc1c0a24ceb4120d76114b69619a835fa62fbc8a7aa7c235995ac601d8dd553_arm64 as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:6133b1bf47b85088de4c372ede3751965a7788a668794e58f17432dd16016687_amd64 as a component of OpenShift Compliance Operator 1
  • registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:df23090ce154d5e3a6a7a06ef88b0f22970ede17554ea193a182bea839c33449_s390x as a component of OpenShift Compliance Operator 1

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on "." characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted. Red Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected. Upstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037). Workaround: To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment. Workaround: Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds. Workaround: There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. Workaround: To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.

🔗 References (24)