Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-32283 (GCVE-0-2026-32283)
Vulnerability from cvelistv5 – Published: 2026-04-08 01:06 – Updated: 2026-04-13 18:19
VLAI
EPSS
Title
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
Summary
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-667 - Improper Locking
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Go standard library | crypto/tls |
Affected:
0 , < 1.25.9
(semver)
Affected: 1.26.0-0 , < 1.26.2 (semver) |
Credits
Jakub Ciolek - https://ciolek.dev/
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-32283",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-13T17:51:46.207289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-13T18:19:55.848Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "crypto/tls",
"product": "crypto/tls",
"programRoutines": [
{
"name": "Conn.handleKeyUpdate"
},
{
"name": "clientHandshakeStateTLS13.establishHandshakeKeys"
},
{
"name": "clientHandshakeStateTLS13.readServerFinished"
},
{
"name": "serverHandshakeStateTLS13.sendServerParameters"
},
{
"name": "serverHandshakeStateTLS13.readClientFinished"
},
{
"name": "Conn.Handshake"
},
{
"name": "Conn.HandshakeContext"
},
{
"name": "Conn.Read"
},
{
"name": "Conn.Write"
},
{
"name": "Dial"
},
{
"name": "DialWithDialer"
},
{
"name": "Dialer.Dial"
},
{
"name": "Dialer.DialContext"
},
{
"name": "QUICConn.HandleData"
},
{
"name": "QUICConn.Start"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.25.9",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.26.2",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jakub Ciolek - https://ciolek.dev/"
}
],
"descriptions": [
{
"lang": "en",
"value": "If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-667: Improper Locking",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T01:06:57.670Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/763767"
},
{
"url": "https://go.dev/issue/78334"
},
{
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"title": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-32283",
"datePublished": "2026-04-08T01:06:57.670Z",
"dateReserved": "2026-03-11T16:38:46.556Z",
"dateUpdated": "2026-04-13T18:19:55.848Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-32283",
"date": "2026-06-07",
"epss": "0.00019",
"percentile": "0.05199"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-32283\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2026-04-08T02:16:03.580\",\"lastModified\":\"2026-04-16T19:12:10.540\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.25.9\",\"matchCriteriaId\":\"C6C9C072-9817-402D-877F-F83584B07017\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.26.0\",\"versionEndExcluding\":\"1.26.2\",\"matchCriteriaId\":\"39FE9BAF-55E9-43AA-B14E-239E7EF1D65D\"}]}]}],\"references\":[{\"url\":\"https://go.dev/cl/763767\",\"source\":\"security@golang.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://go.dev/issue/78334\",\"source\":\"security@golang.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU\",\"source\":\"security@golang.org\",\"tags\":[\"Release Notes\",\"Mailing List\"]},{\"url\":\"https://pkg.go.dev/vuln/GO-2026-4870\",\"source\":\"security@golang.org\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-32283\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-13T17:51:46.207289Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-13T17:51:42.115Z\"}}], \"cna\": {\"title\": \"Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls\", \"credits\": [{\"lang\": \"en\", \"value\": \"Jakub Ciolek - https://ciolek.dev/\"}], \"affected\": [{\"vendor\": \"Go standard library\", \"product\": \"crypto/tls\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.25.9\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.26.0-0\", \"lessThan\": \"1.26.2\", \"versionType\": \"semver\"}], \"packageName\": \"crypto/tls\", \"collectionURL\": \"https://pkg.go.dev\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"Conn.handleKeyUpdate\"}, {\"name\": \"clientHandshakeStateTLS13.establishHandshakeKeys\"}, {\"name\": \"clientHandshakeStateTLS13.readServerFinished\"}, {\"name\": \"serverHandshakeStateTLS13.sendServerParameters\"}, {\"name\": \"serverHandshakeStateTLS13.readClientFinished\"}, {\"name\": \"Conn.Handshake\"}, {\"name\": \"Conn.HandshakeContext\"}, {\"name\": \"Conn.Read\"}, {\"name\": \"Conn.Write\"}, {\"name\": \"Dial\"}, {\"name\": \"DialWithDialer\"}, {\"name\": \"Dialer.Dial\"}, {\"name\": \"Dialer.DialContext\"}, {\"name\": \"QUICConn.HandleData\"}, {\"name\": \"QUICConn.Start\"}]}], \"references\": [{\"url\": \"https://go.dev/cl/763767\"}, {\"url\": \"https://go.dev/issue/78334\"}, {\"url\": \"https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU\"}, {\"url\": \"https://pkg.go.dev/vuln/GO-2026-4870\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-667: Improper Locking\"}]}], \"providerMetadata\": {\"orgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"shortName\": \"Go\", \"dateUpdated\": \"2026-04-08T01:06:57.670Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-32283\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-13T18:19:55.848Z\", \"dateReserved\": \"2026-03-11T16:38:46.556Z\", \"assignerOrgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"datePublished\": \"2026-04-08T01:06:57.670Z\", \"assignerShortName\": \"Go\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:10704
Vulnerability from csaf_redhat - Published: 2026-04-27 02:21 - Updated: 2026-06-08 02:00Summary
Red Hat Security Advisory: go-toolset:rhel8 security update
Severity
Important
Notes
Topic: An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.
Security Fix(es):
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
* golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144)
* cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140)
* golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the Go programming language (golang) and its command-line tool (cmd/go). A remote attacker could exploit this during the build process by crafting malicious SWIG (Simplified Wrapper and Interface Generator) file names that contain "cgo" and specific payloads. This could lead to code smuggling and arbitrary code execution, bypassing trust mechanisms and allowing the attacker to run unauthorized code.
9.0 (Critical)
Affected products
Fixed
31 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the cmd/compile package in the Go standard library. The compiler fails to correctly check for integer overflow or underflow in arithmetic operations involving loop induction variables. As a result, the compiler allows invalid memory indexing to occur at runtime, potentially leading to memory corruption.
8.1 (High)
Affected products
Fixed
31 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data corruption, memory corruption or unexpected application behavior.
8.1 (High)
Affected products
Fixed
31 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
31 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
31 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
31 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
53 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for the go-toolset:rhel8 module is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\n* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)\n\n* golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144)\n\n* cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140)\n\n* golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:10704",
"url": "https://access.redhat.com/errata/RHSA-2026:10704"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "2456340",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456340"
},
{
"category": "external",
"summary": "2456341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456341"
},
{
"category": "external",
"summary": "2456342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456342"
},
{
"category": "external",
"summary": "RHEL-169932",
"url": "https://issues.redhat.com/browse/RHEL-169932"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10704.json"
}
],
"title": "Red Hat Security Advisory: go-toolset:rhel8 security update",
"tracking": {
"current_release_date": "2026-06-08T02:00:08+00:00",
"generator": {
"date": "2026-06-08T02:00:08+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.2"
}
},
"id": "RHSA-2026:10704",
"initial_release_date": "2026-04-27T02:21:42+00:00",
"revision_history": [
{
"date": "2026-04-27T02:21:42+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-27T02:21:42+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-08T02:00:08+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"product": {
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src (go-toolset:rhel8)",
"product_id": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve@1.25.2-1.module%2Bel8.10.0%2B23746%2B9db33b5e?arch=src\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"product": {
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src (go-toolset:rhel8)",
"product_id": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=src\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"product": {
"name": "golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch (go-toolset:rhel8)",
"product_id": "golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-docs@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=noarch\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"product": {
"name": "golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch (go-toolset:rhel8)",
"product_id": "golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-misc@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=noarch\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"product": {
"name": "golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch (go-toolset:rhel8)",
"product_id": "golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-src@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=noarch\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"product": {
"name": "golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch (go-toolset:rhel8)",
"product_id": "golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-tests@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=noarch\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"product": {
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64 (go-toolset:rhel8)",
"product_id": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve@1.25.2-1.module%2Bel8.10.0%2B23746%2B9db33b5e?arch=aarch64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"product": {
"name": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64 (go-toolset:rhel8)",
"product_id": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debuginfo@1.25.2-1.module%2Bel8.10.0%2B23746%2B9db33b5e?arch=aarch64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"product": {
"name": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64 (go-toolset:rhel8)",
"product_id": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debugsource@1.25.2-1.module%2Bel8.10.0%2B23746%2B9db33b5e?arch=aarch64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"product": {
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8)",
"product_id": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=aarch64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"product": {
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8)",
"product_id": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=aarch64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"product": {
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8)",
"product_id": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=aarch64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"product": {
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8)",
"product_id": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=aarch64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"product": {
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le (go-toolset:rhel8)",
"product_id": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve@1.25.2-1.module%2Bel8.10.0%2B23746%2B9db33b5e?arch=ppc64le\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"product": {
"name": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le (go-toolset:rhel8)",
"product_id": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debuginfo@1.25.2-1.module%2Bel8.10.0%2B23746%2B9db33b5e?arch=ppc64le\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"product": {
"name": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le (go-toolset:rhel8)",
"product_id": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debugsource@1.25.2-1.module%2Bel8.10.0%2B23746%2B9db33b5e?arch=ppc64le\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"product": {
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8)",
"product_id": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=ppc64le\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"product": {
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8)",
"product_id": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=ppc64le\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"product": {
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8)",
"product_id": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=ppc64le\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"product": {
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8)",
"product_id": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=ppc64le\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"product": {
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64 (go-toolset:rhel8)",
"product_id": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve@1.25.2-1.module%2Bel8.10.0%2B23746%2B9db33b5e?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"product": {
"name": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64 (go-toolset:rhel8)",
"product_id": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debuginfo@1.25.2-1.module%2Bel8.10.0%2B23746%2B9db33b5e?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"product": {
"name": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64 (go-toolset:rhel8)",
"product_id": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/delve-debugsource@1.25.2-1.module%2Bel8.10.0%2B23746%2B9db33b5e?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"product": {
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8)",
"product_id": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"product": {
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8)",
"product_id": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"product": {
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8)",
"product_id": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"product": {
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8)",
"product_id": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=x86_64\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"product": {
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8)",
"product_id": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/go-toolset@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=s390x\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"product": {
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8)",
"product_id": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=s390x\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"product": {
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8)",
"product_id": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-bin@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=s390x\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
},
{
"category": "product_version",
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"product": {
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8)",
"product_id": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/golang-race@1.25.9-1.module%2Bel8.10.0%2B24226%2Bc418b32c?arch=s390x\u0026rpmmod=go-toolset:rhel8:8100020260422204008:a3795dee"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8"
},
"product_reference": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8"
},
"product_reference": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8"
},
"product_reference": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8"
},
"product_reference": "delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8"
},
"product_reference": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8"
},
"product_reference": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8"
},
"product_reference": "delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8"
},
"product_reference": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8"
},
"product_reference": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8"
},
"product_reference": "delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8"
},
"product_reference": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8"
},
"product_reference": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8"
},
"product_reference": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8"
},
"product_reference": "go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8"
},
"product_reference": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8"
},
"product_reference": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8"
},
"product_reference": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8"
},
"product_reference": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8"
},
"product_reference": "golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8"
},
"product_reference": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8"
},
"product_reference": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8"
},
"product_reference": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8"
},
"product_reference": "golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
},
"product_reference": "golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
},
"product_reference": "golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8"
},
"product_reference": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8"
},
"product_reference": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8"
},
"product_reference": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64 (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8"
},
"product_reference": "golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
},
"product_reference": "golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch (go-toolset:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
},
"product_reference": "golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27140",
"cwe": {
"id": "CWE-641",
"name": "Improper Restriction of Names for Files and Other Resources"
},
"discovery_date": "2026-04-08T02:01:26.299804+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456341"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go programming language (golang) and its command-line tool (cmd/go). A remote attacker could exploit this during the build process by crafting malicious SWIG (Simplified Wrapper and Interface Generator) file names that contain \"cgo\" and specific payloads. This could lead to code smuggling and arbitrary code execution, bypassing trust mechanisms and allowing the attacker to run unauthorized code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27140"
},
{
"category": "external",
"summary": "RHBZ#2456341",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456341"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27140"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27140",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27140"
},
{
"category": "external",
"summary": "https://go.dev/cl/763768",
"url": "https://go.dev/cl/763768"
},
{
"category": "external",
"summary": "https://go.dev/issue/78335",
"url": "https://go.dev/issue/78335"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4871",
"url": "https://pkg.go.dev/vuln/GO-2026-4871"
}
],
"release_date": "2026-04-08T01:06:57.893000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-27T02:21:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10704"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names"
},
{
"cve": "CVE-2026-27143",
"cwe": {
"id": "CWE-733",
"name": "Compiler Optimization Removal or Modification of Security-critical Code"
},
"discovery_date": "2026-04-08T02:01:29.491546+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456342"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the cmd/compile package in the Go standard library. The compiler fails to correctly check for integer overflow or underflow in arithmetic operations involving loop induction variables. As a result, the compiler allows invalid memory indexing to occur at runtime, potentially leading to memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: cmd/compile: possible memory corruption after bound check elimination",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is only exploitable in applications that contain a loop structure that relies on an induction variable. An induction variable is a variable that gets modified, usually incremented or decremented, by a predictable amount on each iteration. Inside the loop, the induction variable must be directly used as the index to access or modify elements within an array or a slice. Additionally, an attacker must be able to cause an integer overflow or underflow in the induction variable to trigger this issue. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27143"
},
{
"category": "external",
"summary": "RHBZ#2456342",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456342"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27143"
},
{
"category": "external",
"summary": "https://go.dev/cl/763765",
"url": "https://go.dev/cl/763765"
},
{
"category": "external",
"summary": "https://go.dev/issue/78333",
"url": "https://go.dev/issue/78333"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4868",
"url": "https://pkg.go.dev/vuln/GO-2026-4868"
}
],
"release_date": "2026-04-08T01:06:57.168000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-27T02:21:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10704"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, strictly sanitize and enforce bounds checking on any untrusted user input that influences loop counters, iteration limits, or memory indices. If there is no integer overflow or underflow, the out-of-bounds access cannot occur.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: cmd/compile: possible memory corruption after bound check elimination"
},
{
"cve": "CVE-2026-27144",
"cwe": {
"id": "CWE-440",
"name": "Expected Behavior Violation"
},
"discovery_date": "2026-04-08T02:01:22.896153+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456340"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the cmd/compile package in the Go standard library. A no-op interface conversion prevented the compiler from correctly identifying non-overlapping memory moves. As a result, the compiler allows unsafe memory move operations to occur at runtime, potentially causing data corruption, memory corruption or unexpected application behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: cmd/compile: no-op interface conversion bypasses overlap checking",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is only exploitable in applications that contain a memory move or copy operation that is subject to a no-op (no-operation) interface conversion. Furthermore, the source and destination memory addresses involved in the move or copy must overlap and an attacker must be able to supply an input that triggers this specific operation. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27144"
},
{
"category": "external",
"summary": "RHBZ#2456340",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456340"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27144"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27144",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27144"
},
{
"category": "external",
"summary": "https://go.dev/cl/763764",
"url": "https://go.dev/cl/763764"
},
{
"category": "external",
"summary": "https://go.dev/issue/78371",
"url": "https://go.dev/issue/78371"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4867",
"url": "https://pkg.go.dev/vuln/GO-2026-4867"
}
],
"release_date": "2026-04-08T01:06:56.908000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-27T02:21:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10704"
},
{
"category": "workaround",
"details": "To mitigate this issue, review code that performs memory copies or struct assignments. If data is being passed through an interface (such as \u0027any\u0027 or \u0027interface{}\u0027) just before a move operation, refactor the code to use concrete types or explicit pointers instead.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: cmd/compile: no-op interface conversion bypasses overlap checking"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-27T02:21:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10704"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-27T02:21:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10704"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-27T02:21:42+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:10704"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debuginfo-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:delve-debugsource-0:1.25.2-1.module+el8.10.0+23746+9db33b5e.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:go-toolset-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.src::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-bin-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-docs-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-misc-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.aarch64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.ppc64le::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.s390x::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-race-0:1.25.9-1.module+el8.10.0+24226+c418b32c.x86_64::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-src-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8",
"AppStream-8.10.0.Z.MAIN.EUS:golang-tests-0:1.25.9-1.module+el8.10.0+24226+c418b32c.noarch::go-toolset:rhel8"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
}
]
}
RHSA-2026:11507
Vulnerability from csaf_redhat - Published: 2026-04-29 07:37 - Updated: 2026-06-08 02:00Summary
Red Hat Security Advisory: grafana security update
Severity
Important
Notes
Topic: An update for grafana is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
28 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for grafana is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\n* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:11507",
"url": "https://access.redhat.com/errata/RHSA-2026:11507"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11507.json"
}
],
"title": "Red Hat Security Advisory: grafana security update",
"tracking": {
"current_release_date": "2026-06-08T02:00:11+00:00",
"generator": {
"date": "2026-06-08T02:00:11+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.2"
}
},
"id": "RHSA-2026:11507",
"initial_release_date": "2026-04-29T07:37:39+00:00",
"revision_history": [
{
"date": "2026-04-29T07:37:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-29T07:37:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-08T02:00:11+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:9.2.10-30.el8_10.src",
"product": {
"name": "grafana-0:9.2.10-30.el8_10.src",
"product_id": "grafana-0:9.2.10-30.el8_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@9.2.10-30.el8_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:9.2.10-30.el8_10.aarch64",
"product": {
"name": "grafana-0:9.2.10-30.el8_10.aarch64",
"product_id": "grafana-0:9.2.10-30.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@9.2.10-30.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"product": {
"name": "grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"product_id": "grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-30.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"product": {
"name": "grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"product_id": "grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-30.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"product": {
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"product_id": "grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-30.el8_10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:9.2.10-30.el8_10.ppc64le",
"product": {
"name": "grafana-0:9.2.10-30.el8_10.ppc64le",
"product_id": "grafana-0:9.2.10-30.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@9.2.10-30.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"product": {
"name": "grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"product_id": "grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-30.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"product": {
"name": "grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"product_id": "grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-30.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"product": {
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"product_id": "grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-30.el8_10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:9.2.10-30.el8_10.x86_64",
"product": {
"name": "grafana-0:9.2.10-30.el8_10.x86_64",
"product_id": "grafana-0:9.2.10-30.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@9.2.10-30.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:9.2.10-30.el8_10.x86_64",
"product": {
"name": "grafana-selinux-0:9.2.10-30.el8_10.x86_64",
"product_id": "grafana-selinux-0:9.2.10-30.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-30.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"product": {
"name": "grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"product_id": "grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-30.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"product": {
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"product_id": "grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-30.el8_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:9.2.10-30.el8_10.s390x",
"product": {
"name": "grafana-0:9.2.10-30.el8_10.s390x",
"product_id": "grafana-0:9.2.10-30.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@9.2.10-30.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:9.2.10-30.el8_10.s390x",
"product": {
"name": "grafana-selinux-0:9.2.10-30.el8_10.s390x",
"product_id": "grafana-selinux-0:9.2.10-30.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@9.2.10-30.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"product": {
"name": "grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"product_id": "grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@9.2.10-30.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"product": {
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"product_id": "grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@9.2.10-30.el8_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:9.2.10-30.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64"
},
"product_reference": "grafana-0:9.2.10-30.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:9.2.10-30.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le"
},
"product_reference": "grafana-0:9.2.10-30.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:9.2.10-30.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x"
},
"product_reference": "grafana-0:9.2.10-30.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:9.2.10-30.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src"
},
"product_reference": "grafana-0:9.2.10-30.el8_10.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:9.2.10-30.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64"
},
"product_reference": "grafana-0:9.2.10-30.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64"
},
"product_reference": "grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le"
},
"product_reference": "grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x"
},
"product_reference": "grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:9.2.10-30.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64"
},
"product_reference": "grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:9.2.10-30.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64"
},
"product_reference": "grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:9.2.10-30.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le"
},
"product_reference": "grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:9.2.10-30.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x"
},
"product_reference": "grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:9.2.10-30.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64"
},
"product_reference": "grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:9.2.10-30.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64"
},
"product_reference": "grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:9.2.10-30.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le"
},
"product_reference": "grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:9.2.10-30.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x"
},
"product_reference": "grafana-selinux-0:9.2.10-30.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:9.2.10-30.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64"
},
"product_reference": "grafana-selinux-0:9.2.10-30.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T07:37:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11507"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T07:37:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11507"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T07:37:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11507"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debuginfo-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-debugsource-0:9.2.10-30.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-selinux-0:9.2.10-30.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
}
]
}
RHSA-2026:11514
Vulnerability from csaf_redhat - Published: 2026-04-29 08:11 - Updated: 2026-06-08 02:00Summary
Red Hat Security Advisory: grafana-pcp security update
Severity
Important
Notes
Topic: An update for grafana-pcp is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.
Security Fix(es):
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
28 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for grafana-pcp is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.\n\nSecurity Fix(es):\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\n* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:11514",
"url": "https://access.redhat.com/errata/RHSA-2026:11514"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11514.json"
}
],
"title": "Red Hat Security Advisory: grafana-pcp security update",
"tracking": {
"current_release_date": "2026-06-08T02:00:12+00:00",
"generator": {
"date": "2026-06-08T02:00:12+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.2"
}
},
"id": "RHSA-2026:11514",
"initial_release_date": "2026-04-29T08:11:59+00:00",
"revision_history": [
{
"date": "2026-04-29T08:11:59+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-29T08:11:59+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-08T02:00:12+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.1.1-14.el8_10.src",
"product": {
"name": "grafana-pcp-0:5.1.1-14.el8_10.src",
"product_id": "grafana-pcp-0:5.1.1-14.el8_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-14.el8_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"product": {
"name": "grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"product_id": "grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-14.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"product": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"product_id": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-14.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"product": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"product_id": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-14.el8_10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"product": {
"name": "grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"product_id": "grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-14.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"product": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"product_id": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-14.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"product": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"product_id": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-14.el8_10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"product": {
"name": "grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"product_id": "grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-14.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64",
"product": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64",
"product_id": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-14.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"product": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"product_id": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-14.el8_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.1.1-14.el8_10.s390x",
"product": {
"name": "grafana-pcp-0:5.1.1-14.el8_10.s390x",
"product_id": "grafana-pcp-0:5.1.1-14.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-14.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"product": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"product_id": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-14.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"product": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"product_id": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-14.el8_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.1.1-14.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64"
},
"product_reference": "grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.1.1-14.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le"
},
"product_reference": "grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.1.1-14.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x"
},
"product_reference": "grafana-pcp-0:5.1.1-14.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.1.1-14.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src"
},
"product_reference": "grafana-pcp-0:5.1.1-14.el8_10.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.1.1-14.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64"
},
"product_reference": "grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64"
},
"product_reference": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le"
},
"product_reference": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x"
},
"product_reference": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64"
},
"product_reference": "grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64"
},
"product_reference": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le"
},
"product_reference": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x"
},
"product_reference": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64"
},
"product_reference": "grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T08:11:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11514"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T08:11:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11514"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T08:11:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11514"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debuginfo-0:5.1.1-14.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:grafana-pcp-debugsource-0:5.1.1-14.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
}
]
}
RHSA-2026:11704
Vulnerability from csaf_redhat - Published: 2026-04-29 13:09 - Updated: 2026-06-08 02:00Summary
Red Hat Security Advisory: grafana-pcp security update
Severity
Important
Notes
Topic: An update for grafana-pcp is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.
Security Fix(es):
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
20 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for grafana-pcp is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.\n\nSecurity Fix(es):\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:11704",
"url": "https://access.redhat.com/errata/RHSA-2026:11704"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11704.json"
}
],
"title": "Red Hat Security Advisory: grafana-pcp security update",
"tracking": {
"current_release_date": "2026-06-08T02:00:14+00:00",
"generator": {
"date": "2026-06-08T02:00:14+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.2"
}
},
"id": "RHSA-2026:11704",
"initial_release_date": "2026-04-29T13:09:25+00:00",
"revision_history": [
{
"date": "2026-04-29T13:09:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-29T13:09:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-08T02:00:14+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.1.1-14.el9_7.src",
"product": {
"name": "grafana-pcp-0:5.1.1-14.el9_7.src",
"product_id": "grafana-pcp-0:5.1.1-14.el9_7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-14.el9_7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.1.1-14.el9_7.aarch64",
"product": {
"name": "grafana-pcp-0:5.1.1-14.el9_7.aarch64",
"product_id": "grafana-pcp-0:5.1.1-14.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-14.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64",
"product": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64",
"product_id": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-14.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64",
"product": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64",
"product_id": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-14.el9_7?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.1.1-14.el9_7.ppc64le",
"product": {
"name": "grafana-pcp-0:5.1.1-14.el9_7.ppc64le",
"product_id": "grafana-pcp-0:5.1.1-14.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-14.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le",
"product": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le",
"product_id": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-14.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le",
"product": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le",
"product_id": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-14.el9_7?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.1.1-14.el9_7.x86_64",
"product": {
"name": "grafana-pcp-0:5.1.1-14.el9_7.x86_64",
"product_id": "grafana-pcp-0:5.1.1-14.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-14.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64",
"product": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64",
"product_id": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-14.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64",
"product": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64",
"product_id": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-14.el9_7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.1.1-14.el9_7.s390x",
"product": {
"name": "grafana-pcp-0:5.1.1-14.el9_7.s390x",
"product_id": "grafana-pcp-0:5.1.1-14.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.1.1-14.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x",
"product": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x",
"product_id": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.1.1-14.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x",
"product": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x",
"product_id": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.1.1-14.el9_7?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.1.1-14.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.aarch64"
},
"product_reference": "grafana-pcp-0:5.1.1-14.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.1.1-14.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.ppc64le"
},
"product_reference": "grafana-pcp-0:5.1.1-14.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.1.1-14.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.s390x"
},
"product_reference": "grafana-pcp-0:5.1.1-14.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.1.1-14.el9_7.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.src"
},
"product_reference": "grafana-pcp-0:5.1.1-14.el9_7.src",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.1.1-14.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.x86_64"
},
"product_reference": "grafana-pcp-0:5.1.1-14.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64"
},
"product_reference": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le"
},
"product_reference": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x"
},
"product_reference": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64"
},
"product_reference": "grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64"
},
"product_reference": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le"
},
"product_reference": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x"
},
"product_reference": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64"
},
"product_reference": "grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T13:09:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11704"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T13:09:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11704"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debuginfo-0:5.1.1-14.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-pcp-debugsource-0:5.1.1-14.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
}
]
}
RHSA-2026:11711
Vulnerability from csaf_redhat - Published: 2026-04-29 13:32 - Updated: 2026-06-08 02:00Summary
Red Hat Security Advisory: grafana security update
Severity
Important
Notes
Topic: An update for grafana is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
20 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for grafana is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:11711",
"url": "https://access.redhat.com/errata/RHSA-2026:11711"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11711.json"
}
],
"title": "Red Hat Security Advisory: grafana security update",
"tracking": {
"current_release_date": "2026-06-08T02:00:15+00:00",
"generator": {
"date": "2026-06-08T02:00:15+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.2"
}
},
"id": "RHSA-2026:11711",
"initial_release_date": "2026-04-29T13:32:55+00:00",
"revision_history": [
{
"date": "2026-04-29T13:32:55+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-29T13:32:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-08T02:00:15+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:10.2.6-21.el9_7.src",
"product": {
"name": "grafana-0:10.2.6-21.el9_7.src",
"product_id": "grafana-0:10.2.6-21.el9_7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@10.2.6-21.el9_7?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:10.2.6-21.el9_7.aarch64",
"product": {
"name": "grafana-0:10.2.6-21.el9_7.aarch64",
"product_id": "grafana-0:10.2.6-21.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@10.2.6-21.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:10.2.6-21.el9_7.aarch64",
"product": {
"name": "grafana-selinux-0:10.2.6-21.el9_7.aarch64",
"product_id": "grafana-selinux-0:10.2.6-21.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-21.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:10.2.6-21.el9_7.aarch64",
"product": {
"name": "grafana-debugsource-0:10.2.6-21.el9_7.aarch64",
"product_id": "grafana-debugsource-0:10.2.6-21.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-21.el9_7?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.aarch64",
"product": {
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.aarch64",
"product_id": "grafana-debuginfo-0:10.2.6-21.el9_7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-21.el9_7?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:10.2.6-21.el9_7.ppc64le",
"product": {
"name": "grafana-0:10.2.6-21.el9_7.ppc64le",
"product_id": "grafana-0:10.2.6-21.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@10.2.6-21.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:10.2.6-21.el9_7.ppc64le",
"product": {
"name": "grafana-selinux-0:10.2.6-21.el9_7.ppc64le",
"product_id": "grafana-selinux-0:10.2.6-21.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-21.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:10.2.6-21.el9_7.ppc64le",
"product": {
"name": "grafana-debugsource-0:10.2.6-21.el9_7.ppc64le",
"product_id": "grafana-debugsource-0:10.2.6-21.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-21.el9_7?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le",
"product": {
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le",
"product_id": "grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-21.el9_7?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:10.2.6-21.el9_7.x86_64",
"product": {
"name": "grafana-0:10.2.6-21.el9_7.x86_64",
"product_id": "grafana-0:10.2.6-21.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@10.2.6-21.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:10.2.6-21.el9_7.x86_64",
"product": {
"name": "grafana-selinux-0:10.2.6-21.el9_7.x86_64",
"product_id": "grafana-selinux-0:10.2.6-21.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-21.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:10.2.6-21.el9_7.x86_64",
"product": {
"name": "grafana-debugsource-0:10.2.6-21.el9_7.x86_64",
"product_id": "grafana-debugsource-0:10.2.6-21.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-21.el9_7?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.x86_64",
"product": {
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.x86_64",
"product_id": "grafana-debuginfo-0:10.2.6-21.el9_7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-21.el9_7?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:10.2.6-21.el9_7.s390x",
"product": {
"name": "grafana-0:10.2.6-21.el9_7.s390x",
"product_id": "grafana-0:10.2.6-21.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@10.2.6-21.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:10.2.6-21.el9_7.s390x",
"product": {
"name": "grafana-selinux-0:10.2.6-21.el9_7.s390x",
"product_id": "grafana-selinux-0:10.2.6-21.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-21.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:10.2.6-21.el9_7.s390x",
"product": {
"name": "grafana-debugsource-0:10.2.6-21.el9_7.s390x",
"product_id": "grafana-debugsource-0:10.2.6-21.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-21.el9_7?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.s390x",
"product": {
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.s390x",
"product_id": "grafana-debuginfo-0:10.2.6-21.el9_7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-21.el9_7?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:10.2.6-21.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.aarch64"
},
"product_reference": "grafana-0:10.2.6-21.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:10.2.6-21.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.ppc64le"
},
"product_reference": "grafana-0:10.2.6-21.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:10.2.6-21.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.s390x"
},
"product_reference": "grafana-0:10.2.6-21.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:10.2.6-21.el9_7.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.src"
},
"product_reference": "grafana-0:10.2.6-21.el9_7.src",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:10.2.6-21.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.x86_64"
},
"product_reference": "grafana-0:10.2.6-21.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.aarch64"
},
"product_reference": "grafana-debuginfo-0:10.2.6-21.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le"
},
"product_reference": "grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.s390x"
},
"product_reference": "grafana-debuginfo-0:10.2.6-21.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:10.2.6-21.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.x86_64"
},
"product_reference": "grafana-debuginfo-0:10.2.6-21.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:10.2.6-21.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.aarch64"
},
"product_reference": "grafana-debugsource-0:10.2.6-21.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:10.2.6-21.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.ppc64le"
},
"product_reference": "grafana-debugsource-0:10.2.6-21.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:10.2.6-21.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.s390x"
},
"product_reference": "grafana-debugsource-0:10.2.6-21.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:10.2.6-21.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.x86_64"
},
"product_reference": "grafana-debugsource-0:10.2.6-21.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:10.2.6-21.el9_7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.aarch64"
},
"product_reference": "grafana-selinux-0:10.2.6-21.el9_7.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:10.2.6-21.el9_7.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.ppc64le"
},
"product_reference": "grafana-selinux-0:10.2.6-21.el9_7.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:10.2.6-21.el9_7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.s390x"
},
"product_reference": "grafana-selinux-0:10.2.6-21.el9_7.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:10.2.6-21.el9_7.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.x86_64"
},
"product_reference": "grafana-selinux-0:10.2.6-21.el9_7.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T13:32:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11711"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T13:32:55+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11711"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.src",
"AppStream-9.7.0.Z.MAIN:grafana-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debuginfo-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-debugsource-0:10.2.6-21.el9_7.x86_64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.aarch64",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.ppc64le",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.s390x",
"AppStream-9.7.0.Z.MAIN:grafana-selinux-0:10.2.6-21.el9_7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
}
]
}
RHSA-2026:11712
Vulnerability from csaf_redhat - Published: 2026-04-29 13:13 - Updated: 2026-06-08 02:00Summary
Red Hat Security Advisory: grafana security update
Severity
Important
Notes
Topic: An update for grafana is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
20 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for grafana is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:11712",
"url": "https://access.redhat.com/errata/RHSA-2026:11712"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11712.json"
}
],
"title": "Red Hat Security Advisory: grafana security update",
"tracking": {
"current_release_date": "2026-06-08T02:00:16+00:00",
"generator": {
"date": "2026-06-08T02:00:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.2"
}
},
"id": "RHSA-2026:11712",
"initial_release_date": "2026-04-29T13:13:50+00:00",
"revision_history": [
{
"date": "2026-04-29T13:13:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-29T13:13:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-08T02:00:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:10.2.6-25.el10_1.src",
"product": {
"name": "grafana-0:10.2.6-25.el10_1.src",
"product_id": "grafana-0:10.2.6-25.el10_1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@10.2.6-25.el10_1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:10.2.6-25.el10_1.aarch64",
"product": {
"name": "grafana-0:10.2.6-25.el10_1.aarch64",
"product_id": "grafana-0:10.2.6-25.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@10.2.6-25.el10_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:10.2.6-25.el10_1.aarch64",
"product": {
"name": "grafana-selinux-0:10.2.6-25.el10_1.aarch64",
"product_id": "grafana-selinux-0:10.2.6-25.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-25.el10_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:10.2.6-25.el10_1.aarch64",
"product": {
"name": "grafana-debugsource-0:10.2.6-25.el10_1.aarch64",
"product_id": "grafana-debugsource-0:10.2.6-25.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-25.el10_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.aarch64",
"product": {
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.aarch64",
"product_id": "grafana-debuginfo-0:10.2.6-25.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-25.el10_1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:10.2.6-25.el10_1.ppc64le",
"product": {
"name": "grafana-0:10.2.6-25.el10_1.ppc64le",
"product_id": "grafana-0:10.2.6-25.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@10.2.6-25.el10_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:10.2.6-25.el10_1.ppc64le",
"product": {
"name": "grafana-selinux-0:10.2.6-25.el10_1.ppc64le",
"product_id": "grafana-selinux-0:10.2.6-25.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-25.el10_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:10.2.6-25.el10_1.ppc64le",
"product": {
"name": "grafana-debugsource-0:10.2.6-25.el10_1.ppc64le",
"product_id": "grafana-debugsource-0:10.2.6-25.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-25.el10_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le",
"product": {
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le",
"product_id": "grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-25.el10_1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:10.2.6-25.el10_1.s390x",
"product": {
"name": "grafana-0:10.2.6-25.el10_1.s390x",
"product_id": "grafana-0:10.2.6-25.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@10.2.6-25.el10_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:10.2.6-25.el10_1.s390x",
"product": {
"name": "grafana-selinux-0:10.2.6-25.el10_1.s390x",
"product_id": "grafana-selinux-0:10.2.6-25.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-25.el10_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:10.2.6-25.el10_1.s390x",
"product": {
"name": "grafana-debugsource-0:10.2.6-25.el10_1.s390x",
"product_id": "grafana-debugsource-0:10.2.6-25.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-25.el10_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.s390x",
"product": {
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.s390x",
"product_id": "grafana-debuginfo-0:10.2.6-25.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-25.el10_1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-0:10.2.6-25.el10_1.x86_64",
"product": {
"name": "grafana-0:10.2.6-25.el10_1.x86_64",
"product_id": "grafana-0:10.2.6-25.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana@10.2.6-25.el10_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-selinux-0:10.2.6-25.el10_1.x86_64",
"product": {
"name": "grafana-selinux-0:10.2.6-25.el10_1.x86_64",
"product_id": "grafana-selinux-0:10.2.6-25.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-25.el10_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-debugsource-0:10.2.6-25.el10_1.x86_64",
"product": {
"name": "grafana-debugsource-0:10.2.6-25.el10_1.x86_64",
"product_id": "grafana-debugsource-0:10.2.6-25.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-25.el10_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.x86_64",
"product": {
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.x86_64",
"product_id": "grafana-debuginfo-0:10.2.6-25.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-25.el10_1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:10.2.6-25.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.aarch64"
},
"product_reference": "grafana-0:10.2.6-25.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:10.2.6-25.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.ppc64le"
},
"product_reference": "grafana-0:10.2.6-25.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:10.2.6-25.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.s390x"
},
"product_reference": "grafana-0:10.2.6-25.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:10.2.6-25.el10_1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.src"
},
"product_reference": "grafana-0:10.2.6-25.el10_1.src",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-0:10.2.6-25.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.x86_64"
},
"product_reference": "grafana-0:10.2.6-25.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.aarch64"
},
"product_reference": "grafana-debuginfo-0:10.2.6-25.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le"
},
"product_reference": "grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.s390x"
},
"product_reference": "grafana-debuginfo-0:10.2.6-25.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debuginfo-0:10.2.6-25.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.x86_64"
},
"product_reference": "grafana-debuginfo-0:10.2.6-25.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:10.2.6-25.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.aarch64"
},
"product_reference": "grafana-debugsource-0:10.2.6-25.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:10.2.6-25.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.ppc64le"
},
"product_reference": "grafana-debugsource-0:10.2.6-25.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:10.2.6-25.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.s390x"
},
"product_reference": "grafana-debugsource-0:10.2.6-25.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-debugsource-0:10.2.6-25.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.x86_64"
},
"product_reference": "grafana-debugsource-0:10.2.6-25.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:10.2.6-25.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.aarch64"
},
"product_reference": "grafana-selinux-0:10.2.6-25.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:10.2.6-25.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.ppc64le"
},
"product_reference": "grafana-selinux-0:10.2.6-25.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:10.2.6-25.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.s390x"
},
"product_reference": "grafana-selinux-0:10.2.6-25.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-selinux-0:10.2.6-25.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.x86_64"
},
"product_reference": "grafana-selinux-0:10.2.6-25.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.src",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T13:13:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.src",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11712"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.src",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.src",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.src",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T13:13:50+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.src",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11712"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.src",
"AppStream-10.1.Z:grafana-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debuginfo-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-debugsource-0:10.2.6-25.el10_1.x86_64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.aarch64",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.s390x",
"AppStream-10.1.Z:grafana-selinux-0:10.2.6-25.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
}
]
}
RHSA-2026:11863
Vulnerability from csaf_redhat - Published: 2026-04-29 17:54 - Updated: 2026-06-08 02:00Summary
Red Hat Security Advisory: rhc-worker-playbook security update
Severity
Important
Notes
Topic: An update for rhc-worker-playbook is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: A worker for yggdrasil that receives Ansible playbooks and executes them against the local host.
Security Fix(es):
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
20 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rhc-worker-playbook is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "A worker for yggdrasil that receives Ansible playbooks and executes them against the local host.\n\nSecurity Fix(es):\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:11863",
"url": "https://access.redhat.com/errata/RHSA-2026:11863"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11863.json"
}
],
"title": "Red Hat Security Advisory: rhc-worker-playbook security update",
"tracking": {
"current_release_date": "2026-06-08T02:00:17+00:00",
"generator": {
"date": "2026-06-08T02:00:17+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.2"
}
},
"id": "RHSA-2026:11863",
"initial_release_date": "2026-04-29T17:54:26+00:00",
"revision_history": [
{
"date": "2026-04-29T17:54:26+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-29T17:54:26+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-08T02:00:17+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.src",
"product": {
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.src",
"product_id": "rhc-worker-playbook-0:0.2.3-5.el10_1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook@0.2.3-5.el10_1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64",
"product": {
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64",
"product_id": "rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook@0.2.3-5.el10_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64",
"product": {
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64",
"product_id": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook-debugsource@0.2.3-5.el10_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64",
"product": {
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64",
"product_id": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook-debuginfo@0.2.3-5.el10_1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le",
"product": {
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le",
"product_id": "rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook@0.2.3-5.el10_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le",
"product": {
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le",
"product_id": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook-debugsource@0.2.3-5.el10_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le",
"product": {
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le",
"product_id": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook-debuginfo@0.2.3-5.el10_1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.s390x",
"product": {
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.s390x",
"product_id": "rhc-worker-playbook-0:0.2.3-5.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook@0.2.3-5.el10_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x",
"product": {
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x",
"product_id": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook-debugsource@0.2.3-5.el10_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x",
"product": {
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x",
"product_id": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook-debuginfo@0.2.3-5.el10_1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64",
"product": {
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64",
"product_id": "rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook@0.2.3-5.el10_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64",
"product": {
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64",
"product_id": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook-debugsource@0.2.3-5.el10_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64",
"product": {
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64",
"product_id": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc-worker-playbook-debuginfo@0.2.3-5.el10_1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64"
},
"product_reference": "rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le"
},
"product_reference": "rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.s390x"
},
"product_reference": "rhc-worker-playbook-0:0.2.3-5.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.src"
},
"product_reference": "rhc-worker-playbook-0:0.2.3-5.el10_1.src",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64"
},
"product_reference": "rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64"
},
"product_reference": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le"
},
"product_reference": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x"
},
"product_reference": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64"
},
"product_reference": "rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64"
},
"product_reference": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le"
},
"product_reference": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x"
},
"product_reference": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64"
},
"product_reference": "rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.src",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T17:54:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.src",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11863"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.src",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.src",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.src",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T17:54:26+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.src",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11863"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.src",
"AppStream-10.1.Z:rhc-worker-playbook-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debuginfo-0:0.2.3-5.el10_1.x86_64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.aarch64",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.ppc64le",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.s390x",
"AppStream-10.1.Z:rhc-worker-playbook-debugsource-0:0.2.3-5.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
}
]
}
RHSA-2026:11881
Vulnerability from csaf_redhat - Published: 2026-04-29 19:06 - Updated: 2026-06-08 02:00Summary
Red Hat Security Advisory: grafana-pcp security update
Severity
Important
Notes
Topic: An update for grafana-pcp is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.
Security Fix(es):
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for grafana-pcp is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.\n\nSecurity Fix(es):\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:11881",
"url": "https://access.redhat.com/errata/RHSA-2026:11881"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11881.json"
}
],
"title": "Red Hat Security Advisory: grafana-pcp security update",
"tracking": {
"current_release_date": "2026-06-08T02:00:18+00:00",
"generator": {
"date": "2026-06-08T02:00:18+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.2"
}
},
"id": "RHSA-2026:11881",
"initial_release_date": "2026-04-29T19:06:36+00:00",
"revision_history": [
{
"date": "2026-04-29T19:06:36+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-29T19:06:36+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-08T02:00:18+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.3.0-4.el10_1.src",
"product": {
"name": "grafana-pcp-0:5.3.0-4.el10_1.src",
"product_id": "grafana-pcp-0:5.3.0-4.el10_1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.3.0-4.el10_1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.3.0-4.el10_1.aarch64",
"product": {
"name": "grafana-pcp-0:5.3.0-4.el10_1.aarch64",
"product_id": "grafana-pcp-0:5.3.0-4.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.3.0-4.el10_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.aarch64",
"product": {
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.aarch64",
"product_id": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.3.0-4.el10_1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.aarch64",
"product": {
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.aarch64",
"product_id": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.3.0-4.el10_1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.3.0-4.el10_1.ppc64le",
"product": {
"name": "grafana-pcp-0:5.3.0-4.el10_1.ppc64le",
"product_id": "grafana-pcp-0:5.3.0-4.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.3.0-4.el10_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.ppc64le",
"product": {
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.ppc64le",
"product_id": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.3.0-4.el10_1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.ppc64le",
"product": {
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.ppc64le",
"product_id": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.3.0-4.el10_1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.3.0-4.el10_1.s390x",
"product": {
"name": "grafana-pcp-0:5.3.0-4.el10_1.s390x",
"product_id": "grafana-pcp-0:5.3.0-4.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.3.0-4.el10_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.s390x",
"product": {
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.s390x",
"product_id": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.3.0-4.el10_1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.s390x",
"product": {
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.s390x",
"product_id": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.3.0-4.el10_1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-pcp-0:5.3.0-4.el10_1.x86_64",
"product": {
"name": "grafana-pcp-0:5.3.0-4.el10_1.x86_64",
"product_id": "grafana-pcp-0:5.3.0-4.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp@5.3.0-4.el10_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.x86_64",
"product": {
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.x86_64",
"product_id": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debugsource@5.3.0-4.el10_1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.x86_64",
"product": {
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.x86_64",
"product_id": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana-pcp-debuginfo@5.3.0-4.el10_1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.3.0-4.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.aarch64"
},
"product_reference": "grafana-pcp-0:5.3.0-4.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.3.0-4.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.ppc64le"
},
"product_reference": "grafana-pcp-0:5.3.0-4.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.3.0-4.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.s390x"
},
"product_reference": "grafana-pcp-0:5.3.0-4.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.3.0-4.el10_1.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.src"
},
"product_reference": "grafana-pcp-0:5.3.0-4.el10_1.src",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-0:5.3.0-4.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.x86_64"
},
"product_reference": "grafana-pcp-0:5.3.0-4.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.aarch64"
},
"product_reference": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.ppc64le"
},
"product_reference": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.s390x"
},
"product_reference": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.x86_64"
},
"product_reference": "grafana-pcp-debuginfo-0:5.3.0-4.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.aarch64"
},
"product_reference": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.aarch64",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.ppc64le"
},
"product_reference": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.ppc64le",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.s390x"
},
"product_reference": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.s390x",
"relates_to_product_reference": "AppStream-10.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.x86_64"
},
"product_reference": "grafana-pcp-debugsource-0:5.3.0-4.el10_1.x86_64",
"relates_to_product_reference": "AppStream-10.1.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.aarch64",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.s390x",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.src",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.x86_64",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.aarch64",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.s390x",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.x86_64",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.aarch64",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.s390x",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-29T19:06:36+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.aarch64",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.s390x",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.src",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.x86_64",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.aarch64",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.s390x",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.x86_64",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.aarch64",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.s390x",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:11881"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.aarch64",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.s390x",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.src",
"AppStream-10.1.Z:grafana-pcp-0:5.3.0-4.el10_1.x86_64",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.aarch64",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.s390x",
"AppStream-10.1.Z:grafana-pcp-debuginfo-0:5.3.0-4.el10_1.x86_64",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.aarch64",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.ppc64le",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.s390x",
"AppStream-10.1.Z:grafana-pcp-debugsource-0:5.3.0-4.el10_1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
}
]
}
RHSA-2026:14162
Vulnerability from csaf_redhat - Published: 2026-05-06 13:54 - Updated: 2026-06-08 02:09Summary
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.3 release
Severity
Important
Notes
Topic: Red Hat build of OpenTelemetry 3.9.3 has been released
Details: This release of the Red Hat build of OpenTelemetry provides security improvements.
Breaking changes:
* None
Deprecations:
* None
Technology Preview features:
* None
Enhancements:
* None
Bug fixes:
* TOCTOU race condition in libcap cap_set_file() function is fixed. Previously, the cap_set_file() function in libcap contained a Time-of-check-to-time-of-use (TOCTOU) race condition. A local unprivileged user with write access to a parent directory could exploit this vulnerability to redirect file capability updates to an attacker-controlled file. This flaw allowed an attacker to inject capabilities into or strip capabilities from unintended executables, leading to privilege escalation. With this update, the race condition in cap_set_file() is fixed. As a result, file capability updates are applied to the intended target files, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-4878.
* Integer overflow vulnerability in Apache Thrift TFramedTransport Go implementation is fixed. Previously, the Apache Thrift TFramedTransport Go language implementation contained an integer overflow or wraparound vulnerability. An attacker could exploit this flaw to cause unexpected behavior or resource exhaustion, leading to a denial of service. With this update, the integer overflow issue is fixed. As a result, TFramedTransport correctly handles integer values, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-41602.
* Denial of service vulnerability in Go crypto/x509 and crypto/tls packages is fixed. Previously, the Go standard library packages crypto/x509 and crypto/tls did not properly limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing an uncontrolled amount of work. This flaw could result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users. With this update, the number of intermediate certificates processed during certificate chain building is properly limited. As a result, the packages handle certificate chains efficiently, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-32280.
* TLS 1.3 connection deadlock vulnerability is fixed. Previously, if one side of a TLS 1.3 connection sent multiple key update messages post-handshake in a single record, the connection could deadlock. This deadlock caused uncontrolled consumption of resources and could lead to a denial of service. With this update, TLS 1.3 connections correctly handle multiple key update messages in a single record. As a result, connections no longer deadlock, and the vulnerability is no longer exploitable. For more information about CVE-2026-32283, see https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU.
* IPC API vulnerability in systemd is fixed. Previously, system and service manager systemd contained a flaw that an unprivileged user could exploit by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this flaw could lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), this flaw caused systemd to assert and freeze, resulting in a denial of service (DoS). With this update, systemd correctly validates IPC API calls. As a result, the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-29111.
Known issues:
* The filesystem scraper does not produce the system.filesystem.inodes.usage and system.filesystem.usage metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.
6.7 (Medium)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).
7.8 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64 | — |
Threats
Impact
Important
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64 | — |
Vendor Fix
fix
|
Known not affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64 | — |
Threats
Impact
Important
A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64 | — |
Vendor Fix
fix
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64 | — |
Threats
Impact
Important
References
50 references
Acknowledgments
Ali Raza
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat build of OpenTelemetry 3.9.3 has been released",
"title": "Topic"
},
{
"category": "general",
"text": "This release of the Red Hat build of OpenTelemetry provides security improvements.\n\n\nBreaking changes:\n\n* None\n\n\nDeprecations:\n\n* None\n\n\nTechnology Preview features:\n\n* None\n\n\nEnhancements:\n\n* None\n\n\nBug fixes:\n\n* TOCTOU race condition in libcap cap_set_file() function is fixed. Previously, the cap_set_file() function in libcap contained a Time-of-check-to-time-of-use (TOCTOU) race condition. A local unprivileged user with write access to a parent directory could exploit this vulnerability to redirect file capability updates to an attacker-controlled file. This flaw allowed an attacker to inject capabilities into or strip capabilities from unintended executables, leading to privilege escalation. With this update, the race condition in cap_set_file() is fixed. As a result, file capability updates are applied to the intended target files, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-4878.\n\n* Integer overflow vulnerability in Apache Thrift TFramedTransport Go implementation is fixed. Previously, the Apache Thrift TFramedTransport Go language implementation contained an integer overflow or wraparound vulnerability. An attacker could exploit this flaw to cause unexpected behavior or resource exhaustion, leading to a denial of service. With this update, the integer overflow issue is fixed. As a result, TFramedTransport correctly handles integer values, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-41602.\n\n* Denial of service vulnerability in Go crypto/x509 and crypto/tls packages is fixed. Previously, the Go standard library packages crypto/x509 and crypto/tls did not properly limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing an uncontrolled amount of work. This flaw could result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users. With this update, the number of intermediate certificates processed during certificate chain building is properly limited. As a result, the packages handle certificate chains efficiently, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-32280.\n\n* TLS 1.3 connection deadlock vulnerability is fixed. Previously, if one side of a TLS 1.3 connection sent multiple key update messages post-handshake in a single record, the connection could deadlock. This deadlock caused uncontrolled consumption of resources and could lead to a denial of service. With this update, TLS 1.3 connections correctly handle multiple key update messages in a single record. As a result, connections no longer deadlock, and the vulnerability is no longer exploitable. For more information about CVE-2026-32283, see https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU.\n\n* IPC API vulnerability in systemd is fixed. Previously, system and service manager systemd contained a flaw that an unprivileged user could exploit by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this flaw could lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), this flaw caused systemd to assert and freeze, resulting in a denial of service (DoS). With this update, systemd correctly validates IPC API calls. As a result, the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-29111.\n\n\nKnown issues:\n\n* The filesystem scraper does not produce the system.filesystem.inodes.usage and system.filesystem.usage metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:14162",
"url": "https://access.redhat.com/errata/RHSA-2026:14162"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29111",
"url": "https://access.redhat.com/security/cve/CVE-2026-29111"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32283",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41602",
"url": "https://access.redhat.com/security/cve/CVE-2026-41602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4878",
"url": "https://access.redhat.com/security/cve/CVE-2026-4878"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14162.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.3 release",
"tracking": {
"current_release_date": "2026-06-08T02:09:47+00:00",
"generator": {
"date": "2026-06-08T02:09:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.2"
}
},
"id": "RHSA-2026:14162",
"initial_release_date": "2026-05-06T13:54:24+00:00",
"revision_history": [
{
"date": "2026-05-06T13:54:24+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-06T13:54:36+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-08T02:09:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift distributed tracing 3.9.3",
"product": {
"name": "Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift distributed tracing"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-operator-bundle@sha256%3A736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778059129"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3Aa12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056233"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Ac8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056245"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3Afcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056233"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Ac87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056245"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3Ad52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056233"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3A676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056245"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056233"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Aa2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056245"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
"product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ali Raza"
]
}
],
"cve": "CVE-2026-4878",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-03-26T06:56:21.213270+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451615"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. A Time-of-Check-to-Time-of-Use (TOCTOU) race condition in libcap\u0027s cap_set_file() allows a local unprivileged user to escalate privileges. An attacker with write access to a parent directory can exploit a narrow window during file capability updates to redirect capabilities to an attacker-controlled file. This can lead to the injection of elevated privileges into an unintended executable when privileged processes, such as setcap or container tooling, invoke cap_set_file() on attacker-influenced paths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4878"
},
{
"category": "external",
"summary": "RHBZ#2451615",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4878",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4878"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878"
},
{
"category": "external",
"summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554"
}
],
"release_date": "2026-04-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T13:54:24+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14162"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()"
},
{
"cve": "CVE-2026-29111",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-03-23T22:01:54.593547+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29111"
},
{
"category": "external",
"summary": "RHBZ#2450505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a",
"url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412",
"url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
"url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f",
"url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f",
"url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69",
"url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6",
"url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c",
"url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
"url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764",
"url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"
}
],
"release_date": "2026-03-23T21:03:56.120000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T13:54:24+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14162"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T13:54:24+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14162"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T13:54:24+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14162"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
},
{
"cve": "CVE-2026-41602",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-28T10:01:16.099816+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463407"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41602"
},
{
"category": "external",
"summary": "RHBZ#2463407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463407"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/6",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/6"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:19:06.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T13:54:24+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14162"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
"Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation"
}
]
}
RHSA-2026:14200
Vulnerability from csaf_redhat - Published: 2026-05-06 15:34 - Updated: 2026-06-08 02:00Summary
Red Hat Security Advisory: git-lfs security update
Severity
Important
Notes
Topic: An update for git-lfs is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.
Security Fix(es):
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
28 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for git-lfs is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.\n\nSecurity Fix(es):\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\n* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:14200",
"url": "https://access.redhat.com/errata/RHSA-2026:14200"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14200.json"
}
],
"title": "Red Hat Security Advisory: git-lfs security update",
"tracking": {
"current_release_date": "2026-06-08T02:00:23+00:00",
"generator": {
"date": "2026-06-08T02:00:23+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.8.2"
}
},
"id": "RHSA-2026:14200",
"initial_release_date": "2026-05-06T15:34:47+00:00",
"revision_history": [
{
"date": "2026-05-06T15:34:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-06T15:34:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-08T02:00:23+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"product": {
"name": "git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"product_id": "git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs@3.6.1-8.el9_7.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64",
"product": {
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64",
"product_id": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs-debugsource@3.6.1-8.el9_7.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"product": {
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"product_id": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs-debuginfo@3.6.1-8.el9_7.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "git-lfs-0:3.6.1-8.el9_7.1.s390x",
"product": {
"name": "git-lfs-0:3.6.1-8.el9_7.1.s390x",
"product_id": "git-lfs-0:3.6.1-8.el9_7.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs@3.6.1-8.el9_7.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"product": {
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"product_id": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs-debugsource@3.6.1-8.el9_7.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"product": {
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"product_id": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs-debuginfo@3.6.1-8.el9_7.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "git-lfs-0:3.6.1-8.el9_7.1.src",
"product": {
"name": "git-lfs-0:3.6.1-8.el9_7.1.src",
"product_id": "git-lfs-0:3.6.1-8.el9_7.1.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs@3.6.1-8.el9_7.1?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"product": {
"name": "git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"product_id": "git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs@3.6.1-8.el9_7.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"product": {
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"product_id": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs-debugsource@3.6.1-8.el9_7.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"product": {
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"product_id": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs-debuginfo@3.6.1-8.el9_7.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"product": {
"name": "git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"product_id": "git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs@3.6.1-8.el9_7.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"product": {
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"product_id": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs-debugsource@3.6.1-8.el9_7.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"product": {
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"product_id": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/git-lfs-debuginfo@3.6.1-8.el9_7.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-0:3.6.1-8.el9_7.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64"
},
"product_reference": "git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-0:3.6.1-8.el9_7.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le"
},
"product_reference": "git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-0:3.6.1-8.el9_7.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x"
},
"product_reference": "git-lfs-0:3.6.1-8.el9_7.1.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-0:3.6.1-8.el9_7.1.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src"
},
"product_reference": "git-lfs-0:3.6.1-8.el9_7.1.src",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-0:3.6.1-8.el9_7.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64"
},
"product_reference": "git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64"
},
"product_reference": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le"
},
"product_reference": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x"
},
"product_reference": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64"
},
"product_reference": "git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64"
},
"product_reference": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le"
},
"product_reference": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x"
},
"product_reference": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64"
},
"product_reference": "git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64",
"relates_to_product_reference": "AppStream-9.7.0.Z.MAIN"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T15:34:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14200"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T15:34:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14200"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-06T15:34:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:14200"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.src",
"AppStream-9.7.0.Z.MAIN:git-lfs-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debuginfo-0:3.6.1-8.el9_7.1.x86_64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.aarch64",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.ppc64le",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.s390x",
"AppStream-9.7.0.Z.MAIN:git-lfs-debugsource-0:3.6.1-8.el9_7.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…