RHSA-2026:42082
Vulnerability from csaf_redhat - Published: 2026-07-20 16:05 - Updated: 2026-07-22 11:36Summary
Red Hat Security Advisory: Satellite 6.16.11 Async Update
Severity
Important
Notes
Topic: An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details: Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.
Security Fix(es):
* yggdrasil-worker-forwarder: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
* yggdrasil-worker-forwarder: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* yggdrasil-worker-forwarder: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* python-pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport (CVE-2026-12701)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.
9.0 (Critical)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch | — |
Vendor Fix
fix
Workaround
|
Known not affected
22 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64 | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
|
| Unresolved product id: 9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch | — |
Workaround
|
Threats
Impact
Important
References
35 references
Acknowledgments
Independent security researcher
Martin Brodeur
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat Satellite 6.16 for RHEL 8 and RHEL 9.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Satellite is a system management solution that allows organizations\nto configure and maintain their systems without the necessity to provide\npublic Internet access to their servers or other client systems. It\nperforms provisioning and configuration management of predefined standard\noperating environments.\n\nSecurity Fix(es):\n\n* yggdrasil-worker-forwarder: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)\n\n* yggdrasil-worker-forwarder: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)\n\n* yggdrasil-worker-forwarder: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n\n* python-pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport (CVE-2026-12701)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:42082",
"url": "https://access.redhat.com/errata/RHSA-2026:42082"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "2490703",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490703"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42082.json"
}
],
"title": "Red Hat Security Advisory: Satellite 6.16.11 Async Update",
"tracking": {
"current_release_date": "2026-07-22T11:36:14+00:00",
"generator": {
"date": "2026-07-22T11:36:14+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:42082",
"initial_release_date": "2026-07-20T16:05:07+00:00",
"revision_history": [
{
"date": "2026-07-20T16:05:07+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-20T16:05:07+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-22T11:36:14+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.16::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_capsule:6.16::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-utils",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_utils:6.16::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.16::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_capsule:6.16::el9"
}
}
},
{
"category": "product_name",
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product": {
"name": "Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-utils",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite_utils:6.16::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite 6"
},
{
"branches": [
{
"category": "product_version",
"name": "python-pulpcore-0:3.49.39-2.el8pc.src",
"product": {
"name": "python-pulpcore-0:3.49.39-2.el8pc.src",
"product_id": "python-pulpcore-0:3.49.39-2.el8pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pulpcore@3.49.39-2.el8pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"product": {
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"product_id": "yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/yggdrasil-worker-forwarder@0.0.4-1.el8sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.16.11-1.el8sat.src",
"product": {
"name": "satellite-0:6.16.11-1.el8sat.src",
"product_id": "satellite-0:6.16.11-1.el8sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.16.11-1.el8sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "python-pulpcore-0:3.49.39-2.el9pc.src",
"product": {
"name": "python-pulpcore-0:3.49.39-2.el9pc.src",
"product_id": "python-pulpcore-0:3.49.39-2.el9pc.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-pulpcore@3.49.39-2.el9pc?arch=src"
}
}
},
{
"category": "product_version",
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"product": {
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"product_id": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/yggdrasil-worker-forwarder@0.0.4-1.el9sat?arch=src"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.16.11-1.el9sat.src",
"product": {
"name": "satellite-0:6.16.11-1.el9sat.src",
"product_id": "satellite-0:6.16.11-1.el9sat.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.16.11-1.el9sat?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"product": {
"name": "python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"product_id": "python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pulpcore@3.49.39-2.el8pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.16.11-1.el8sat.noarch",
"product": {
"name": "satellite-0:6.16.11-1.el8sat.noarch",
"product_id": "satellite-0:6.16.11-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.16.11-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-cli-0:6.16.11-1.el8sat.noarch",
"product": {
"name": "satellite-cli-0:6.16.11-1.el8sat.noarch",
"product_id": "satellite-cli-0:6.16.11-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-cli@6.16.11-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-common-0:6.16.11-1.el8sat.noarch",
"product": {
"name": "satellite-common-0:6.16.11-1.el8sat.noarch",
"product_id": "satellite-common-0:6.16.11-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-common@6.16.11-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-capsule-0:6.16.11-1.el8sat.noarch",
"product": {
"name": "satellite-capsule-0:6.16.11-1.el8sat.noarch",
"product_id": "satellite-capsule-0:6.16.11-1.el8sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-capsule@6.16.11-1.el8sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"product": {
"name": "python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"product_id": "python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3.11-pulpcore@3.49.39-2.el9pc?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-0:6.16.11-1.el9sat.noarch",
"product": {
"name": "satellite-0:6.16.11-1.el9sat.noarch",
"product_id": "satellite-0:6.16.11-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite@6.16.11-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-cli-0:6.16.11-1.el9sat.noarch",
"product": {
"name": "satellite-cli-0:6.16.11-1.el9sat.noarch",
"product_id": "satellite-cli-0:6.16.11-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-cli@6.16.11-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-common-0:6.16.11-1.el9sat.noarch",
"product": {
"name": "satellite-common-0:6.16.11-1.el9sat.noarch",
"product_id": "satellite-common-0:6.16.11-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-common@6.16.11-1.el9sat?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "satellite-capsule-0:6.16.11-1.el9sat.noarch",
"product": {
"name": "satellite-capsule-0:6.16.11-1.el9sat.noarch",
"product_id": "satellite-capsule-0:6.16.11-1.el9sat.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/satellite-capsule@6.16.11-1.el9sat?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"product": {
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"product_id": "yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/yggdrasil-worker-forwarder@0.0.4-1.el8sat?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64",
"product": {
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64",
"product_id": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/yggdrasil-worker-forwarder@0.0.4-1.el9sat?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pulpcore-0:3.49.39-2.el8pc.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src"
},
"product_reference": "python-pulpcore-0:3.49.39-2.el8pc.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pulpcore-0:3.49.39-2.el8pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch"
},
"product_reference": "python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.11-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src"
},
"product_reference": "satellite-0:6.16.11-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-capsule-0:6.16.11-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch"
},
"product_reference": "satellite-capsule-0:6.16.11-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.16.11-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch"
},
"product_reference": "satellite-common-0:6.16.11-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.11-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src"
},
"product_reference": "satellite-0:6.16.11-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.16.11-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch"
},
"product_reference": "satellite-cli-0:6.16.11-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pulpcore-0:3.49.39-2.el8pc.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src"
},
"product_reference": "python-pulpcore-0:3.49.39-2.el8pc.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pulpcore-0:3.49.39-2.el8pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch"
},
"product_reference": "python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.11-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch"
},
"product_reference": "satellite-0:6.16.11-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.11-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src"
},
"product_reference": "satellite-0:6.16.11-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.16.11-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch"
},
"product_reference": "satellite-cli-0:6.16.11-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.16.11-1.el8sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch"
},
"product_reference": "satellite-common-0:6.16.11-1.el8sat.noarch",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src"
},
"product_reference": "yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 8",
"product_id": "8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64"
},
"product_reference": "yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"relates_to_product_reference": "8Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pulpcore-0:3.49.39-2.el9pc.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src"
},
"product_reference": "python-pulpcore-0:3.49.39-2.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pulpcore-0:3.49.39-2.el9pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch"
},
"product_reference": "python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.11-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src"
},
"product_reference": "satellite-0:6.16.11-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-capsule-0:6.16.11-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch"
},
"product_reference": "satellite-capsule-0:6.16.11-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.16.11-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch"
},
"product_reference": "satellite-common-0:6.16.11-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-capsule"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.11-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src"
},
"product_reference": "satellite-0:6.16.11-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.16.11-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch"
},
"product_reference": "satellite-cli-0:6.16.11-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16-utils"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-pulpcore-0:3.49.39-2.el9pc.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src"
},
"product_reference": "python-pulpcore-0:3.49.39-2.el9pc.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3.11-pulpcore-0:3.49.39-2.el9pc.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch"
},
"product_reference": "python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.11-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch"
},
"product_reference": "satellite-0:6.16.11-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-0:6.16.11-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src"
},
"product_reference": "satellite-0:6.16.11-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-cli-0:6.16.11-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch"
},
"product_reference": "satellite-cli-0:6.16.11-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "satellite-common-0:6.16.11-1.el9sat.noarch as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch"
},
"product_reference": "satellite-common-0:6.16.11-1.el9sat.noarch",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src"
},
"product_reference": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"relates_to_product_reference": "9Base-satellite-6.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64 as a component of Red Hat Satellite 6.16 for RHEL 9",
"product_id": "9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
},
"product_reference": "yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64",
"relates_to_product_reference": "9Base-satellite-6.16"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Martin Brodeur"
],
"organization": "Independent security researcher"
}
],
"cve": "CVE-2026-12701",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-04-24T02:44:10+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490703"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with \"/\" but fails to block directory traversal sequences such as \"../\" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., \"looking/normal/../../../../etc/shadow\") that escapes the intended export directory during FilesystemExport operations. Because the file content is also user-controlled (uploaded artifact), this allows arbitrary file write to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an authenticated administrator can achieve arbitrary file write outside the intended export directory with fully attacker-controlled content. The FilesystemExport API is restricted to admin-level users (in Satellite, authenticated via SSL certificate; in standalone RBAC deployments, admin role only). The Pulp process runs as the \"pulp\" system user (not root), and file permission bits cannot be controlled by the attacker. However, the \"pulp\" user typically has write access to service-critical paths, and attack vectors such as cron.d entries (text-parsed, no exec bit required) or overwriting Pulp configuration remain viable depending on filesystem permissions and SELinux policy. Red Hat Satellite and Red Hat Ansible Automation Hub ship pulpcore and are affected. RHUI is not affected because end users do not have access to Pulp content creation APIs.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12701"
},
{
"category": "external",
"summary": "RHBZ#2490703",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490703"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12701",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12701"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12701",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12701"
}
],
"release_date": "2026-07-20T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-20T16:05:07+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42082"
},
{
"category": "workaround",
"details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If FilesystemExport was never configured on your deployment, you are not affected by this issue.\n2. If FilesystemExporters exist in the database, audit them for path traversal sequences (\"../\"). Existing malicious entries must be cleaned up manually, as the validation functions documented to raise ValidationError do not actually do so in all code paths.\n3. Restrict admin-level access to the Pulp API to only trusted operators. Review and audit which accounts have administrator privileges.\n4. Ensure SELinux is in enforcing mode on Satellite/Pulp servers to limit the directories the Pulp service user can write to.\n5. Monitor filesystem changes outside of expected Pulp directories for signs of exploitation.",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport"
},
{
"cve": "CVE-2026-27145",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-02T23:01:08.992540+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package of `golang`. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name (SAN) entries. The certificate verification process, specifically the `VerifyHostname` function, incurs excessive computational overhead due to repeated string operations when processing these entries. This can lead to a significant performance degradation or unresponsiveness of systems validating such certificates.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27145"
},
{
"category": "external",
"summary": "RHBZ#2484207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27145"
},
{
"category": "external",
"summary": "https://go.dev/cl/783621",
"url": "https://go.dev/cl/783621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79694",
"url": "https://go.dev/issue/79694"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5037",
"url": "https://pkg.go.dev/vuln/GO-2026-5037"
}
],
"release_date": "2026-06-02T22:01:36.954000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-20T16:05:07+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42082"
},
{
"category": "workaround",
"details": "A flaw was found in the Go standard library crypto/x509 package. When verifying a TLS certificate hostname, VerifyHostname processed each DNS Subject Alternative Name (SAN) entry in a loop and repeatedly split the candidate hostname on \".\" characters. For certificates with a very large DNS SAN list, CPU use could grow quadratically with the number of SAN entries and hostname labels. Because hostname verification runs before the certificate chain is built, this overhead can occur even when the certificate is not trusted.\n\nRed Hat rates this issue as Important. It affects Red Hat products that include the Go standard library crypto/x509 code from an affected Go toolchain version (before Go 1.25.11, or from Go 1.26.0 through Go 1.26.3). Applications and container images built with a fixed Go release (1.25.11 or later, or 1.26.4 or later) are not affected. Community distributions such as Fedora are also affected.\n\nUpstream fix: Go 1.25.11 and Go 1.26.4 (GO-2026-5037).",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-20T16:05:07+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42082"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
],
"known_not_affected": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-20T16:05:07+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index",
"product_ids": [
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42082"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16-utils:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el8pc.src",
"8Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el8pc.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-0:6.16.11-1.el8sat.src",
"8Base-satellite-6.16:satellite-cli-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:satellite-common-0:6.16.11-1.el8sat.noarch",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.src",
"8Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el8sat.x86_64",
"9Base-satellite-6.16-capsule:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16-capsule:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16-capsule:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-capsule:satellite-capsule-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-capsule:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16-utils:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16-utils:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:python-pulpcore-0:3.49.39-2.el9pc.src",
"9Base-satellite-6.16:python3.11-pulpcore-0:3.49.39-2.el9pc.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-0:6.16.11-1.el9sat.src",
"9Base-satellite-6.16:satellite-cli-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:satellite-common-0:6.16.11-1.el9sat.noarch",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.src",
"9Base-satellite-6.16:yggdrasil-worker-forwarder-0:0.0.4-1.el9sat.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…