RHSA-2026:55898

Vulnerability from csaf_redhat - Published: 2026-08-18 00:11 - Updated: 2026-08-25 09:25
Summary
Red Hat Security Advisory: Red Hat Web Terminal Operator 1.12.1 release.
Severity
Important
Notes
Topic: Red Hat Web Terminal Operator 1.12.1 has been released.
Details: The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).

CWE-764 - Multiple Locks of a Critical Resource
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64
Vendor Fix fix
Product Identifier Version Remediation
Unresolved product id: Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64
Unresolved product id: Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64
Unresolved product id: Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64
Threats
Impact Important

A flaw was found in the `net` package of Go (golang). When running on Windows, the `Dial` and `LookupPort` functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service (DoS) for applications using these functions.

CWE-617 - Reachable Assertion
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64
Workaround
Unresolved product id: Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64
Workaround
Unresolved product id: Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64
Workaround
Threats
Impact Moderate

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Web Terminal Operator 1.12.1 has been released.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:55898",
        "url": "https://access.redhat.com/errata/RHSA-2026:55898"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32283",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32283"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39836",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39836"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-441",
        "url": "https://redhat.atlassian.net/browse/WTO-441"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-505",
        "url": "https://redhat.atlassian.net/browse/WTO-505"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55898.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Web Terminal Operator 1.12.1 release.",
    "tracking": {
      "current_release_date": "2026-08-25T09:25:46+00:00",
      "generator": {
        "date": "2026-08-25T09:25:46+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:55898",
      "initial_release_date": "2026-08-18T00:11:36+00:00",
      "revision_history": [
        {
          "date": "2026-08-18T00:11:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-22T06:15:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-25T09:25:46+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Web Terminal 1.12",
                "product": {
                  "name": "Red Hat Web Terminal 1.12",
                  "product_id": "Red Hat Web Terminal 1.12",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:webterminal:1.12::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Web Terminal"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-exec-rhel9@sha256%3A2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-exec-rhel9\u0026tag=1786654613"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-rhel9-operator@sha256%3Adb4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-rhel9-operator\u0026tag=1786654942"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-operator-bundle@sha256%3A2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-operator-bundle\u0026tag=1786654923"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-tooling-rhel9@sha256%3Aa5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-tooling-rhel9\u0026tag=1786655166"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64 as a component of Red Hat Web Terminal 1.12",
          "product_id": "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64 as a component of Red Hat Web Terminal 1.12",
          "product_id": "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64 as a component of Red Hat Web Terminal 1.12",
          "product_id": "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64 as a component of Red Hat Web Terminal 1.12",
          "product_id": "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-32283",
      "cwe": {
        "id": "CWE-764",
        "name": "Multiple Locks of a Critical Resource"
      },
      "discovery_date": "2026-04-08T02:01:16.213799+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456338"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A flaw in the Go `crypto/tls` package allows a remote attacker to cause a denial of service in applications using TLS 1.3. By sending multiple key update messages in a single record post-handshake, an attacker can trigger a connection deadlock, leading to uncontrolled resource consumption. This impacts Red Hat products utilizing the affected Go standard library for TLS 1.3 connections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64",
          "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64",
          "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456338",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763767",
          "url": "https://go.dev/cl/763767"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78334",
          "url": "https://go.dev/issue/78334"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4870",
          "url": "https://pkg.go.dev/vuln/GO-2026-4870"
        }
      ],
      "release_date": "2026-04-08T01:06:57.670000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T00:11:36+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.17 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55898"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "cve": "CVE-2026-39836",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-05-07T20:01:49.423498+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net` package of Go (golang). When running on Windows, the `Dial` and `LookupPort` functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a specially crafted input, leading to a denial of service (DoS) for applications using these functions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This denial of service flaw exists within the Go `net` package, specifically impacting applications when executed on Microsoft Windows operating systems. Red Hat Product Security has rated this flaw as a Moderate as Red Hat products primarily deploy Go applications on Linux-based environments. Customers operating Go applications, including those bundled with Red Hat products, within a Windows environment should assess their exposure to this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64",
          "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64",
          "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39836"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39836",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39836"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39836",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39836"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/775320",
          "url": "https://go.dev/cl/775320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79006",
          "url": "https://go.dev/issue/79006"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4971",
          "url": "https://pkg.go.dev/vuln/GO-2026-4971"
        }
      ],
      "release_date": "2026-05-07T19:41:18.300000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-18T00:11:36+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.17 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:55898"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:2fbac1ddd75833f997cb864dd28fd639446ba243cdaf2dbe8df39f6e0e960c95_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:2d3c389629fc5883bd71a9ce74846995d846cba41cc5407d930f993fd88226c9_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:db4ae6558120c65d6669fb8865c4b6631f4555ca65a6914cc365b2addd07aa16_amd64",
            "Red Hat Web Terminal 1.12:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:a5c68396c51ea804a4d47a4ed7840be3783882544aa6544fd4ec61f0666c1a55_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…

Loading…